Controller
Vendor:
First CVE: Jan 7, 2025 · Active for 1 year
21
Total CVEs
More Total CVEs than 94% of tracked products
10.5
Avg CVEs / Year
Higher CVE frequency than 96% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 26% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Controller over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 7, 2025
18 months ago
Most Recent CVE
May 27, 2026
58 days ago
CVE Severity & Scoring
Controller21 CVEs
10%
57%
33%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network21 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low18 (85.7%)
High3 (14.3%)
Unknown0 (0.0%)
User Interaction
None18 (85.7%)
Unknown0 (0.0%)
Required3 (14.3%)
Privileges Required
Low14 (66.7%)
High1 (4.8%)
None6 (28.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-5065HIGH IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbou | May 27, 2026 | 8.8 | 32 | NO | NO |
CVE-2025-36326HIGH IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptograp | Sep 26, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-28777HIGH IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
is vulnerable to unrestricted deserialization. This vulnerability allows users to execute arbitrary co | Feb 19, 2025 | 8.8 | 24 | NO | NO |
CVE-2024-52902HIGH IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthori | Feb 19, 2025 | 8.8 | 24 | NO | NO |
CVE-2024-45084HIGH IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary | Feb 19, 2025 | 8.0 | 23 | NO | NO |
CVE-2025-36017MEDIUM IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obta | Dec 8, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-36015MEDIUM IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation o | Dec 8, 2025 | 6.5 | 22 | NO | NO |
CVE-2023-47160HIGH IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote at | Feb 19, 2025 | 8.2 | 22 | NO | NO |
CVE-2024-40702HIGH IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper | Jan 7, 2025 | 8.2 | 22 | NO | NO |
CVE-2024-41778MEDIUM IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts | Mar 1, 2025 | 6.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (21 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (21 CVEs).
Media Mentions
Signals from CVEs in this product scope (21 CVEs).
Top CNAs Publishing CVEs For Controller
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 11.1.0 | 15 | 6.4 | 0.4% | 0 | 0 |
| 11.0.1 | 1 | 6.5 | 0.3% | 0 | 0 |
| 11.0.0 | 1 | 6.5 | 0.3% | 0 | 0 |