CVE-2025-33147: IBM Cognos Analytics Information Disclosure

CVE-2025-33147 Overview

CVE-2025-33147 affects IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2. The vulnerability stems from insecure network communication that could expose sensitive information to attackers positioned on a shared network. IBM classifies this issue under CWE-327: Use of a Broken or Risky Cryptographic Algorithm. An attacker on the same network segment can intercept traffic and recover sensitive data transmitted between clients and the Cognos Analytics server.

Critical Impact
Attackers on a shared network can obtain sensitive information from IBM Cognos Analytics communications due to weak cryptographic protection.

Affected Products

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1
IBM Cognos Analytics 12.0.4 through 12.0.4 FP2
Deployments relying on default network communication settings

Discovery Timeline

2026-09-18 - CVE-2025-33147 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2025-33147

Vulnerability Analysis

CVE-2025-33147 is an information disclosure vulnerability rooted in insecure network communication. IBM Cognos Analytics transmits data over channels that do not adequately protect confidentiality, as reflected by the CWE-327 classification. An adversary positioned on the same broadcast domain or shared network path can passively observe or actively intercept traffic. The impact is limited to confidentiality; integrity and availability are not affected. The attack complexity is elevated because the adversary must gain a suitable network position and observe traffic containing sensitive material.

Root Cause

The root cause is the use of broken or risky cryptographic protection for network communication in affected Cognos Analytics builds. This may include weak cipher suites, deprecated protocol versions, or missing transport encryption for specific service endpoints. Sensitive artifacts transmitted between the client, application tier, and back-end services become recoverable to a network observer.

Attack Vector

Exploitation requires network adjacency to victim traffic. An attacker on a shared LAN, misconfigured VLAN, or compromised network segment performs passive capture or an active man-in-the-middle position. When Cognos Analytics session data, credentials, report content, or metadata traverses the weakly protected channel, the attacker extracts it from captured frames. No authentication or user interaction is required to observe the traffic.

No verified public exploit code is available. See the IBM Support Article for vendor technical details.

Detection Methods for CVE-2025-33147

Indicators of Compromise

Unexpected ARP table changes or duplicate MAC entries indicating ARP spoofing on segments serving Cognos Analytics clients
TLS negotiations to Cognos endpoints using deprecated protocol versions or weak cipher suites
Unusual promiscuous-mode network interfaces on hosts adjacent to Cognos Analytics servers

Detection Strategies

Inventory Cognos Analytics deployments and compare running versions against the affected ranges 12.1.0–12.1.3 FP1 and 12.0.4–12.0.4 FP2
Perform active TLS scanning of Cognos service endpoints to identify weak ciphers, legacy protocol support, and missing encryption on internal ports
Correlate authentication and session anomalies with network capture events on segments hosting Cognos infrastructure

Monitoring Recommendations

Log and alert on new Layer 2 anomalies, including ARP or NDP poisoning, on subnets that carry Cognos Analytics traffic
Monitor TLS handshake telemetry for downgrade attempts against Cognos hostnames
Baseline outbound data volumes from Cognos servers and alert on deviations that could indicate interception infrastructure

How to Mitigate CVE-2025-33147

Immediate Actions Required

Upgrade IBM Cognos Analytics to the fixed release identified in the IBM Support Article
Restrict Cognos Analytics network segments to trusted hosts and enforce Layer 2 protections against ARP and NDP spoofing
Enforce TLS 1.2 or higher with modern cipher suites on all Cognos service endpoints and disable legacy protocols

Patch Information

IBM has released fixes documented in the IBM Support Article. Administrators running 12.1.0 through 12.1.3 FP1 or 12.0.4 through 12.0.4 FP2 must apply the vendor-supplied fix pack to remediate the insecure communication weakness [CWE-327].

Workarounds

Place Cognos Analytics servers behind a reverse proxy that terminates TLS with a hardened configuration
Segment Cognos traffic into dedicated VLANs with private VLAN isolation to reduce shared-network exposure
Require VPN or zero-trust network access for client connections until the vendor patch is applied

bash

# Configuration example
# Verify TLS configuration exposed by a Cognos endpoint
nmap --script ssl-enum-ciphers -p 443 cognos.example.local

# Restrict a Cognos server segment with host-based firewall rules (Linux)
iptables -A INPUT -p tcp --dport 9300 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9300 -j DROP