IBM Cognos Analytics and Cognos Transformer versions specified are affected by a stored XSS vulnerability (CWE-79) in the administration interface. A privileged user can embed malicious JavaScript code in the web UI, which may lead to altered functionality and possible credential disclosure during a trusted session. The vulnerability is network exploitable with low attack complexity, requires privileges, and no user interaction. The CVSS vector indicates partial confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is available at this time.

The vulnerability allows a privileged user to execute arbitrary JavaScript in the context of the Cognos web interface, potentially leading to credential disclosure within a trusted session. This could compromise the confidentiality and integrity of the affected system's data and user credentials. There is no indication of availability impact or exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict privileged user access to trusted personnel only and monitor for suspicious activity related to the administration interface. Avoid exposing the administration interface to untrusted networks.