CVE-2016-8960: IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Cap...

Security readout for executives and security teams

IBM Cognos Business Intelligence 10.2 could let a lower-privileged user act with a higher-privileged user's capabilities if that user's HTTP cookie is intercepted and reused. This is mainly a session and privilege boundary risk for organizations still running affected Cognos versions, especially where plaintext HTTP may exist. Exposure is likely limited to IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 deployments. Risk is higher where Cognos traffic used HTTP or where session cookies could be observed by another authenticated user or network position. Prioritize this if Cognos BI 10.2 remains in use, because the issue affects privilege boundaries in a business intelligence platform. If the product is retired or fully upgraded, residual urgency is low. Evidence is incomplete, so confirm status against IBM guidance before remediation decisions. Mitigation focus: Review IBM advisory 1993718 for the official fix or supported upgrade path.; Identify and retire unsupported Cognos BI 10.2 family deployments.; Confirm Cognos access is restricted to trusted networks and authenticated users..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.