What is CVE-2026-15995?

CVE-2026-15995 is a medium-severity vulnerability in IBM Cognos Analytics, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.4/10. Published 2026-07-17.

How severe is CVE-2026-15995?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in IBM Cognos Analytics

CVE-2026-15995

IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple authenticated users submit report-related tasks simultaneously.

Vulnerability class: Race Condition

EPSS: 0.001 (1.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Ibm Cognos Analytics — versions 12.1.3 GA Version with build number
Ibm Cognos_analytics — versions 12.1.3

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

psirt@us.ibm.com (vendor-advisory, patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-15995?: CVE-2026-15995 is a medium-severity vulnerability in IBM Cognos Analytics, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.4/10. Published 2026-07-17.
How severe is CVE-2026-15995?: Medium severity. CVSS v3 base score is 5.4 out of 10.