This vulnerability (CVE-2025-33147) affects IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2. The issue is caused by the use of a broken or risky cryptographic algorithm (CWE-327) that results in insecure network communication. An attacker on the same network segment could exploit this weakness to obtain sensitive information transmitted by the affected software. The CVSS v3.1 base score is 5.9, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An attacker with network access to the same shared network as the vulnerable IBM Cognos Analytics instance could exploit the insecure cryptographic algorithm to intercept and obtain sensitive information. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor IBM's advisories for updates and apply any official patches or mitigations once available. Until then, consider limiting network exposure of affected versions to trusted networks only.