# CVE-2026-15995: IBM Cognos Analytics race condition in Agentic AI assistant

Source: https://junglewise.ai/threats/cve-2026-15995-ibm-cognos-analytics-race-condition-in-agentic-ai-assistant  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-15995 · Severity: medium · CVSS 5.4 · Published 2026-07-17

IBM Cognos Analytics is a business intelligence platform used for data reporting and analysis. A flaw in its AI assistant component could allow authenticated users to inadvertently receive incorrect report data or cause system errors when multiple people run reports at the same time. This issue impacts data integrity and the reliability of business reports, though it requires the attacker to have valid login credentials.

Technologies: [IBM Cognos Analytics](https://junglewise.ai/threats/technologies/cognos-analytics). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-15995 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15995 being exploited in the wild.

**How severe is CVE-2026-15995?** Medium severity, with a CVSS score of 5.4, published 17 July 2026.

**Which products and versions are affected?** IBM Cognos Analytics 12.1.3 GA through build 12.1.3-2606251736.

**Is there a fix for CVE-2026-15995?** A patch was published on 2026-07-16: Updated package released on Passport Advantage Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15995 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15995?** Check whether you run IBM Cognos Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition (CWE-362) exists in the Agentic AI assistant's concurrent request-handling logic within IBM Cognos Analytics. The vulnerability is triggered when multiple authenticated users submit report-related tasks or queries simultaneously through the user interface. An attacker with low-privileged network access can exploit this improper synchronization of shared resources to cause data integrity issues (incorrect report summaries) or a partial denial of service (processing failures). IBM has released an updated package (build 12.1.3-2607110822) to remediate the issue.

## Affected products

- IBM Cognos Analytics 12.1.3 GA through build 12.1.3-2606251736

## Timeline

- 2026-07-16: patched: Updated package released on Passport Advantage
- 2026-07-17: disclosed: Initial advisory publication

## References

- [https://www.ibm.com/support/pages/node/7280311](https://www.ibm.com/support/pages/node/7280311)

## Related threats

- [IBM Cognos Analytics sensitive information exposure in source code](https://junglewise.ai/threats/cve-2025-36076-ibm-cognos-analytics-sensitive-information-exposure-in-source)
- [IBM Cognos Analytics insecure network communication](https://junglewise.ai/threats/cve-2025-33147-ibm-cognos-analytics-12-1-0-through-12-1-3-fp1-and-12-0-4-through)
- [IBM Cognos Analytics missing HTTP Strict Transport Security](https://junglewise.ai/threats/cve-2024-56344-ibm-cognos-analytics-missing-http-strict-transport-security)
- [IBM Cognos Analytics stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-7884-ibm-cognos-analytics-stored-cross-site-scripting-in-user-profile)
- [IBM Cognos Analytics cross-site scripting in web interface](https://junglewise.ai/threats/cve-2025-3633-ibm-cognos-analytics-cross-site-scripting-in-web-interface)