CVE-2025-36326

IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7246015	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:cognos_controller::::::::
	cpe:2.3:a:ibm:controller::::::::

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM Cognos Controller 11.0.0 hasta 11.0.1, e IBM Controller 11.1.0 hasta 11.1.1 podrían permitir a un atacante obtener información sensible debido al uso de claves criptográficas codificadas de forma rígida para firmar cookies de sesión.

Information

Published : 2025-09-26 15:16

Updated : 2026-10-18 21:10

NVD link : CVE-2025-36326

Mitre link : CVE-2025-36326

CVE.ORG link : CVE-2025-36326

JSON object : View

Products Affected

ibm

cognos_controller
controller

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2025-36326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T14:54:16.381196Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Cognos Controller", "versions": [{"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.1"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Controller", "versions": [{"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-26T15:16:03.437", "references": [{"url": "https://www.ibm.com/support/pages/node/7246015", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies."}, {"lang": "es", "value": "IBM Cognos Controller 11.0.0 hasta 11.0.1, e IBM Controller 11.1.0 hasta 11.1.1 podr\u00edan permitir a un atacante obtener informaci\u00f3n sensible debido al uso de claves criptogr\u00e1ficas codificadas de forma r\u00edgida para firmar cookies de sesi\u00f3n."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FACCAE0A-7AE8-4E8A-A407-191C260B6F91", "versionEndIncluding": "11.0.1", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:ibm:controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DEB42CB-5D84-498E-82D3-0EA268A4E599", "versionEndIncluding": "11.1.1", "versionStartIncluding": "11.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}