This vulnerability (CVE-2025-36126) is a stored cross-site scripting (CWE-79) issue in IBM Cognos Analytics and Cognos Transformer products. It allows a privileged user to embed arbitrary JavaScript code in the web administration interface, which can modify the UI behavior and potentially expose sensitive information such as credentials. The vulnerability affects multiple versions of IBM Cognos Analytics (11.2.0, 12.0, 12.1.0) and Cognos Transformer (11.2.4, 12.0, 12.1.0). The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or official fix has been documented in the provided data.

An attacker with privileged access to the Cognos Administration interface can exploit this vulnerability to inject malicious JavaScript code. This can lead to altered web UI behavior and potential disclosure of credentials within the trusted session. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged user access to trusted personnel only and monitor for suspicious activity related to the Cognos Administration interface. Avoid exposing the administration interface to untrusted networks. Follow IBM's official advisories for updates on patches or mitigations.