CVE-2026-14963 · Vendor
NO FIX YET
IBM Cognos Command Center versions 10.2.4.1 and 10.2.5 accept forged cross-site requests that can make a logged-in user's session execute unauthorized processes. An attacker who gets a victim to load a malicious page can trigger those actions remotely.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Cognos Command Center 10.2.4.1 or 10.2.5 are named as affected, and the flaw is reached through a victim's browser session. Teams that do not run these versions can skip it. The sources do not say which configurations or roles are required.
Not affected if other-versions
Who cares ibm-cognos-command-center, self-hosted
10.2.4.1 or 10.2.5No fix yet, per the sources.
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.