CVE-2026-15995: cognos analytics 12.1.3 · update 2606251736; +1 more affected products

Affected technology

cognos analytics · 12.1.3 · update 2606251736
ibm

Cognos Analytics · 12.1.3 GA Version with build number through 12.1.3-2606251736
IBM

Description’s affected range: Version with build number through 12.1.3-2606251736 could

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An attacker could obtain incorrect report summary results or cause report-processing failures due to a race condition in the Agentic AI assistant's concurrent request-handling logic when multiple authenticated users submit report-related tasks simultaneously. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 4.2/10) rates confidentiality and integrity impact as low; availability impact as none.