# CVE-2025-3633: IBM Cognos Analytics cross-site scripting in web interface

Source: https://junglewise.ai/threats/cve-2025-3633-ibm-cognos-analytics-cross-site-scripting-in-web-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2025-3633 · Severity: medium · CVSS 5.4 · Published 2026-05-27

IBM Cognos Analytics and Transformer, which are business intelligence and data modeling tools, are affected by a security flaw that allows attackers to run malicious scripts in a user's browser. If a logged-in user interacts with a malicious link or page, an attacker could potentially steal their login credentials or perform unauthorized actions on their behalf. This could lead to unauthorized access to sensitive corporate data and reports.

Technologies: [IBM Cognos Analytics](https://junglewise.ai/threats/technologies/cognos-analytics). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-3633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-3633 being exploited in the wild.

**How severe is CVE-2025-3633?** Medium severity, with a CVSS score of 5.4, published 27 May 2026.

**Which products and versions are affected?** IBM Cognos Transformer 11.2.4, 12.0, 12.1.0; IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, 12.1.0.

**Is there a fix for CVE-2025-3633?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-3633 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-3633?** Check whether you run IBM Cognos Transformer or IBM Cognos Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Cognos Analytics and Transformer are vulnerable to a stored or reflected cross-site scripting (XSS) attack due to improper neutralization of user-supplied input during web page generation (CWE-79). A remote attacker with low privileges can exploit this by injecting arbitrary JavaScript code into the web user interface. Successful exploitation requires a victim to interact with the malicious content (User Interaction: Required). This can lead to the disclosure of sensitive session information, such as credentials or session tokens, within a trusted session, and allows the attacker to alter the intended functionality of the web interface.

## Affected products

- IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, 12.1.0
- IBM Cognos Transformer 11.2.4, 12.0, 12.1.0

## Timeline

- 2026-05-27: advisory: NVD published the CVE record based on IBM's disclosure.

## References

- [https://www.ibm.com/support/pages/node/7272628](https://www.ibm.com/support/pages/node/7272628)

## Related threats

- [IBM Cognos Analytics sensitive information exposure in source code](https://junglewise.ai/threats/cve-2025-36076-ibm-cognos-analytics-sensitive-information-exposure-in-source)
- [IBM Cognos Analytics insecure network communication](https://junglewise.ai/threats/cve-2025-33147-ibm-cognos-analytics-12-1-0-through-12-1-3-fp1-and-12-0-4-through)
- [IBM Cognos Analytics missing HTTP Strict Transport Security](https://junglewise.ai/threats/cve-2024-56344-ibm-cognos-analytics-missing-http-strict-transport-security)
- [IBM Cognos Analytics stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-7884-ibm-cognos-analytics-stored-cross-site-scripting-in-user-profile)
- [IBM Cognos Analytics race condition in Agentic AI assistant](https://junglewise.ai/threats/cve-2026-15995-ibm-cognos-analytics-race-condition-in-agentic-ai-assistant)