IBM Cognos Analytics 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)

high Nessus Plugin ID 347959

Language:

Synopsis

The remote host is missing one or more security updates.

Description

The version of IBM Cognos Analytics installed on the remote host is 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7287209. These vulnerabilities are applicable only to version 12.1.3 due to newer functionalities and an updated software stack:

- Arbitrary class instantiation via model manifest in Apache OpenNLP ExtensionLoader. The ExtensionLoader.instantiateExtension() method loads a class by its fully-qualified name via Class.forName() and invokes its no-arg constructor, with the class name sourced from the manifest.properties entry of a model archive. An attacker who can supply a crafted model archive can cause the static initializer of any class on the classpath to run during model loading.
(CVE-2026-42027)

- XML External Entity (XXE) via unsanitized dictionary parsing in Apache OpenNLP DictionaryEntryPersistor. An attacker who can supply a crafted dictionary file containing a malicious DOCTYPE declaration can trigger local file disclosure via file:// entity references or server-side request forgery via http:// entity references during SAX parsing. (CVE-2026-40682)

- An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath, resulting in arbitrary code execution on the Apache ActiveMQ broker's JVM. (CVE-2026-40466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to IBM Cognos Analytics 12.1.3 FP2 or later.

Plugin Details

Severity: High

ID: 347959

File Name: ibm_cognos_7287209_12_1.nasl

Version: 1.4

Type: Remote

Family: CGI abuses

Published: 9/18/2026

Updated: 9/21/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.7

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-14742

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 9.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2025-62718

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 8.7

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-59936

Vulnerability Information

CPE: cpe:/a:ibm:cognos_analytics

Required KB Items: installed_sw/IBM Cognos Analytics

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/11/2026

Vulnerability Publication Date: 12/8/2025

CISA Known Exploited Vulnerability Due Dates: 9/16/2026

Reference Information

CVE: CVE-2025-12635, CVE-2025-14915, CVE-2025-14923, CVE-2025-33147, CVE-2025-62718, CVE-2026-14742, CVE-2026-1561, CVE-2026-24051, CVE-2026-25646, CVE-2026-27024, CVE-2026-27025, CVE-2026-27026, CVE-2026-33416, CVE-2026-3713, CVE-2026-39824, CVE-2026-40466, CVE-2026-40682, CVE-2026-41044, CVE-2026-42027, CVE-2026-42198, CVE-2026-42440, CVE-2026-45205, CVE-2026-4539, CVE-2026-48155, CVE-2026-48156, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-49851, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938

IAVB: 2026-B-0261

Detections

Analytics