CVE-2025-36015: IBM Cognos Controller DOS Vulnerability

CVE-2025-36015 is a denial of service vulnerability in IBM Cognos Controller caused by improper validation of quantity size input. Authenticated users can exploit this flaw to disrupt service availability. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-36015 Overview

CVE-2025-36015 is a denial-of-service vulnerability affecting IBM Controller and IBM Cognos Controller. The flaw stems from improper validation of a specified quantity size input, allowing an authenticated user to disrupt service availability over the network. The issue is tracked under CWE-1284: Improper Validation of Specified Quantity in Input.

IBM Controller versions 11.1.0 through 11.1.1 and IBM Cognos Controller versions 11.0.0 through 11.0.1 FP6 are affected. Exploitation requires valid credentials but no user interaction, and the impact is limited to availability.

Critical Impact
An authenticated attacker can trigger a denial-of-service condition on IBM Controller instances, disrupting financial consolidation and reporting workflows that depend on the application.

Affected Products

IBM Controller 11.1.0 through 11.1.1
IBM Cognos Controller 11.0.0 through 11.0.1 FP6
Deployments referenced by CPE cpe:2.3:a:ibm:controller and cpe:2.3:a:ibm:cognos_controller

Discovery Timeline

2025-12-08 - CVE-2025-36015 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36015

Vulnerability Analysis

CVE-2025-36015 is an input validation flaw in IBM Controller and IBM Cognos Controller. The application does not adequately validate a quantity size value supplied by an authenticated user. When the value falls outside the expected range, downstream processing consumes excessive resources or reaches an unrecoverable state.

The result is a denial-of-service condition that prevents legitimate users from accessing Controller functions. Confidentiality and integrity are not affected. The vulnerability is exploitable over the network and requires only low-privileged authenticated access.

Root Cause

The root cause is improper validation of a specified quantity size input, classified as [CWE-1284]. IBM Controller accepts a size or count value from a client request without enforcing sufficient bounds checks. Malformed or oversized quantities are propagated into processing paths that exhaust memory, CPU, or thread resources.

Attack Vector

An authenticated attacker sends a crafted request containing an unexpected quantity value to a vulnerable Controller endpoint. Because the attack originates over the network and requires no user interaction, an attacker with a valid low-privileged account can trigger the condition repeatedly. Refer to the IBM Support Article for vendor guidance on affected endpoints.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-36015

Indicators of Compromise

Unexpected termination, restart events, or unresponsiveness of the IBM Controller application server
Authenticated requests containing anomalously large numeric or quantity parameters directed at Controller endpoints
Spikes in CPU, memory, or thread pool utilization coinciding with authenticated user sessions

Detection Strategies

Inspect Controller application and web server logs for repeated requests from a single authenticated session preceding a service failure
Correlate authentication events with subsequent availability degradation to identify low-privileged accounts triggering the flaw
Baseline typical request parameter sizes and alert on outliers submitted to Controller APIs

Monitoring Recommendations

Enable verbose logging on the Controller application tier and forward events to a centralized SIEM for correlation
Monitor host-level performance counters on Controller servers for sustained resource exhaustion
Track failed and successful logins against Controller accounts, focusing on service accounts and rarely used identities

How to Mitigate CVE-2025-36015

Immediate Actions Required

Apply the fix referenced in the IBM Support Article for affected Controller and Cognos Controller versions
Inventory Controller deployments and confirm version levels against the affected range
Restrict Controller network access to trusted management networks and authenticated users only
Review and disable unused Controller accounts to reduce the authenticated attack surface

Patch Information

IBM has published remediation guidance for CVE-2025-36015 in the vendor advisory at IBM Support node 7253273. Administrators should upgrade IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 to the fixed release identified by IBM.

Workarounds

Enforce least-privilege access so only required users can authenticate to Controller
Place a reverse proxy or web application firewall in front of Controller to enforce request size and parameter validation
Rate-limit authenticated requests to Controller endpoints to reduce impact if the flaw is triggered
Schedule regular restarts and health checks to reduce downtime duration if a denial-of-service event occurs

bash

# Configuration example
# Refer to the IBM Support advisory for the exact patch procedure:
# https://www.ibm.com/support/pages/node/7253273