Vulnerability · Published Dec 8, 2025 · Assigned by ibm
CVE-2025-33111IBM Controller Information Disclosure
Medium 4.3
In plain English
A medium-severity security flaw in Cognos Controller from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Controller | 11.1.0 – through 11.1.1 |
| IBM | Cognos Controller | 11.0.0 – through 11.0.1 FP6 |
Weakness: CWE-379 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://www.ibm.com/support/pages/node/7253273 vendor-advisory, patch