Quick answers
- Is CVE-2026-15995 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15995 being exploited in the wild.
- How severe is CVE-2026-15995?
- Medium severity, with a CVSS score of 5.4, published 17 July 2026.
- Which products and versions are affected?
- IBM Cognos Analytics 12.1.3 GA through build 12.1.3-2606251736.
- Is there a fix for CVE-2026-15995?
- A patch was published on 2026-07-16: Updated package released on Passport Advantage Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15995 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-15995?
- Check whether you run IBM Cognos Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition (CWE-362) exists in the Agentic AI assistant's concurrent request-handling logic within IBM Cognos Analytics. The vulnerability is triggered when multiple authenticated users submit report-related tasks or queries simultaneously through the user interface. An attacker with low-privileged network access can exploit this improper synchronization of shared resources to cause data integrity issues (incorrect report summaries) or a partial denial of service (processing failures). IBM has released an updated package (build 12.1.3-2607110822) to remediate the issue.
Affected products
- IBM Cognos Analytics 12.1.3 GA through build 12.1.3-2606251736
Timeline
- 2026-07-16: patched: Updated package released on Passport Advantage
- 2026-07-17: disclosed: Initial advisory publication