What is CVE-2026-7884?

CVE-2026-7884 is a medium-severity vulnerability in IBM Cognos Analytics, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-09-14.

How severe is CVE-2026-7884?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in IBM Cognos Analytics

CVE-2026-7884

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the malicious JavaScript code is executed. This could result in the cookies from the administrator being compromised.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Ibm Cognos Analytics

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-7884?: CVE-2026-7884 is a medium-severity vulnerability in IBM Cognos Analytics, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-09-14.
How severe is CVE-2026-7884?: Medium severity. CVSS v3 base score is 5.4 out of 10.