CVE-2025-36326

Full vulnerability record from the local CVENow database.
Description

IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.
Severity
HIGH
CVSS score
7.5 (v3.1)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2025-09-26 15:16:03.437000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
  "id": "CVE-2025-36326",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-26T15:16:03.437",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies."
    },
    {
      "lang": "es",
      "value": "IBM Cognos Controller 11.0.0 hasta 11.0.1, e IBM Controller 11.1.0 hasta 11.1.1 podrían permitir a un atacante obtener información sensible debido al uso de claves criptográficas codificadas de forma rígida para firmar cookies de sesión."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Cognos Controller",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.0.0",
              "lessThanOrEqual": "11.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Controller",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "11.1.0",
              "lessThanOrEqual": "11.1.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-26T14:54:16.381196Z",
          "id": "CVE-2025-36326",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:cognos_controller:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndIncluding": "11.0.1",
              "matchCriteriaId": "FACCAE0A-7AE8-4E8A-A407-191C260B6F91"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:controller:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.1.0",
              "versionEndIncluding": "11.1.1",
              "matchCriteriaId": "8DEB42CB-5D84-498E-82D3-0EA268A4E599"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7246015",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}