IBM Cognos Analytics EUVD-2025-209930

Exploitation requires an attacker to hold a valid account with at least low-level privileges in IBM Cognos Administration (CVSS PR:L), accessible over the network (CVSS AV:N). The attack targets the Cognos Administration interface specifically - deployments that do not expose this interface to broader user populations, or that restrict write access tightly to dedicated admin accounts, significantly reduce the realistic attacker pool. Impact depends on a privileged victim user subsequently loading the affected administrative page (scope change via S:C), meaning exploitation is not purely unilateral - the stored payload must be triggered by another user's browsing action. Non-default configurations are not required; the vulnerability affects the standard Cognos Administration interface. The description's reference to 'privileged user' as the attacker may indicate that write access to Cognos Administration itself is the prerequisite, which should be confirmed against the vendor advisory - if true, this limits exploitation to users already trusted with administrative-level access to the product.

The CVSS 6.4 (Medium) reflects a network-reachable, low-complexity attack requiring low privileges with changed scope but only partial confidentiality and integrity impact. The CVSS PR:L (low privileges required) is worth scrutinizing against the description's reference to 'a privileged user' as the actor - this may indicate a low-level admin or any user with write access to Cognos Administration, which should be verified with the vendor advisory. SSVC signals align with low urgency: exploitation is rated 'none', the attack is not automatable (Automatable: no), and technical impact is only 'partial'. EPSS at 0.03% (8th percentile) confirms no observed exploitation momentum in the threat landscape. No KEV listing and no public exploit identified at time of analysis further reduce prioritization urgency. Realistically, this vulnerability poses meaningful risk only in environments where Cognos Administration is exposed to a broad internal user base with mixed privilege levels, and where credential disclosure from an admin session would have significant downstream consequences.

An internal user with low-level access to Cognos Administration crafts a malicious JavaScript snippet and embeds it into a Cognos Administration UI field that persists the payload server-side. When a higher-privileged administrator subsequently loads the affected administration page, the stored script executes silently in their browser session, capturing session tokens or credentials and exfiltrating them to an attacker-controlled endpoint. No public exploit code for this specific vulnerability has been identified at time of analysis, but stored XSS techniques in admin panels are well-understood and frequently exploited in authenticated-attacker scenarios.