CVE-2025-36326 LOW

CVE-2025-36326: IBM Controller information disclosure

Vendor Ibm
Product Cognos Controller
Weakness CWE-321
Published September 26, 2025
Last update September 26, 2025
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.

Key dates

02Disclosure timeline

September 26, 2025 CVE published
September 26, 2025 Record updated