CVE-2026-7884 describes a stored cross-site scripting (XSS) vulnerability in IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2. A non-privileged user can edit their given name and surname fields to include malicious JavaScript code. This code executes in the context of an administrator's session when the administrator accesses the user account management panel and views the affected user's permissions. The vulnerability could lead to compromise of administrator cookies, potentially enabling session hijacking or other attacks that leverage stolen cookies.

The vulnerability allows execution of malicious JavaScript in an administrator's browser, which can lead to theft of administrator cookies. This compromises the confidentiality of administrator sessions and may enable unauthorized actions under the administrator's privileges. There is no indication of impact on availability. The attack requires the administrator to view the manipulated user account, so user interaction is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability of non-privileged users to modify their given name and surname fields or sanitize inputs to prevent JavaScript injection. Administrators should be cautious when viewing user account details and consider additional monitoring for suspicious activity related to user management.