CVE-2025-36326: IBM Cognos Controller Info Disclosure Flaw

CVE-2025-36326 Overview

IBM Cognos Controller and IBM Controller contain a critical security vulnerability stemming from the use of hardcoded cryptographic keys for signing session cookies. This weakness (CWE-321: Use of Hard-coded Cryptographic Key) allows remote attackers to obtain sensitive information without requiring authentication or user interaction. Organizations relying on these financial consolidation and reporting solutions should treat this as a high-priority security concern.

Critical Impact

Attackers can exploit hardcoded cryptographic keys to forge or decrypt session cookies, potentially gaining unauthorized access to sensitive financial data and user sessions across the affected IBM Cognos Controller and Controller deployments.

Affected Products

• IBM Cognos Controller 11.0.0 through 11.0.1
• IBM Controller 11.1.0 through 11.1.1

Discovery Timeline

• 2025-09-26 - CVE-2025-36326 published to NVD
• 2025-10-03 - Last updated in NVD database

Technical Details for CVE-2025-36326

Vulnerability Analysis

This vulnerability falls under CWE-321: Use of Hard-coded Cryptographic Key, a well-documented cryptographic weakness that occurs when an application embeds static cryptographic keys directly within its codebase or configuration. In the case of IBM Cognos Controller and IBM Controller, these hardcoded keys are used to sign session cookies, which fundamentally undermines the security guarantees that cryptographic signing is meant to provide.

When cryptographic keys are hardcoded, they become discoverable through reverse engineering, binary analysis, or comparison across multiple installations. Once an attacker obtains these keys, they can craft valid session cookies that the application will trust, potentially leading to session hijacking, impersonation of legitimate users, or extraction of sensitive session data.

The vulnerability is particularly concerning for financial consolidation software like IBM Cognos Controller, which typically processes sensitive corporate financial data, consolidation reports, and may contain privileged access controls for financial administrators.

Root Cause

The root cause of this vulnerability is the implementation decision to embed static cryptographic keys directly into the application rather than generating unique keys during installation or deployment. This approach, while simplifying deployment and configuration, creates a scenario where all installations share identical cryptographic material.

Secure key management practices dictate that cryptographic keys should be:

• Generated uniquely per installation
• Stored securely outside the application codebase
• Rotated periodically
• Protected from unauthorized access

The hardcoded key approach in IBM Cognos Controller violates these fundamental security principles, creating a systemic vulnerability across all affected deployments.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker would need to:

1. Obtain the hardcoded cryptographic key through analysis of the IBM Cognos Controller application
2. Use the discovered key to forge or decrypt session cookies
3. Submit the crafted cookies to gain unauthorized access to sensitive information

The network-accessible nature of this vulnerability, combined with the lack of authentication requirements, makes it exploitable by external threat actors who can reach the affected application endpoints. The attack focuses on information disclosure, allowing unauthorized access to confidential data stored within or processed by the affected IBM Controller products.

Detection Methods for CVE-2025-36326

Indicators of Compromise

• Unusual session cookie activity or cookies with unexpected attributes appearing in application logs
• Multiple sessions originating from different geographic locations using similar or identical session tokens
• Access to sensitive financial data or reports without corresponding authentication events
• Anomalous API requests or data extraction patterns targeting financial consolidation endpoints

Detection Strategies

• Implement web application firewall (WAF) rules to detect anomalous session cookie patterns or tampering attempts
• Monitor authentication and session management logs for sessions created without proper authentication workflows
• Deploy network traffic analysis to identify unusual communication patterns with IBM Cognos Controller endpoints
• Configure SIEM rules to correlate session activity with authentication events and flag discrepancies

Monitoring Recommendations

• Enable detailed audit logging for all session creation and data access events in IBM Cognos Controller
• Implement real-time alerting for access to sensitive financial consolidation data
• Monitor for any unauthorized data exports or bulk data retrieval operations
• Track version information of deployed IBM Cognos Controller instances to ensure patching status

How to Mitigate CVE-2025-36326

Immediate Actions Required

• Review the IBM Support Page for official remediation guidance and apply available patches
• Conduct an inventory of all IBM Cognos Controller and IBM Controller deployments within your organization
• Implement network segmentation to limit exposure of affected systems while patches are applied
• Invalidate existing sessions and force re-authentication after applying security updates

Patch Information

IBM has released security guidance addressing this vulnerability. Organizations should consult the official IBM Support Page for detailed patch information, supported upgrade paths, and specific remediation instructions for their deployed versions.

Affected versions requiring updates:

• IBM Cognos Controller 11.0.0 through 11.0.1
• IBM Controller 11.1.0 through 11.1.1

Workarounds

• Restrict network access to IBM Cognos Controller to trusted internal networks only using firewall rules
• Implement additional authentication layers such as VPN or reverse proxy with authentication in front of the application
• Enable enhanced session monitoring and implement automatic session termination for suspicious activity
• Consider deploying a web application firewall (WAF) with custom rules to validate session cookie integrity

# Example: Restrict network access to IBM Cognos Controller
# Add firewall rules to limit access to trusted networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Review active sessions and connections
netstat -an | grep :443 | grep ESTABLISHED