CVE-2023-40696 is a medium severity weakness in IBM Cognos Controller 10.4.1, 10.4.2 and 11.0.0. NVD scores it 5.9. The product uses weaker cryptographic algorithms than expected, which could let an attacker decrypt sensitive information. IBM's fixes are 11.0.1 FP2, 10.4.2 FP3 and 10.4.1 FP1.
What's affected
IBM's bulletin, "IBM Controller has addressed multiple vulnerabilities", lists IBM Controller 11.0.0, 10.4.2 and 10.4.1 as affected. The weakness is CWE-327, use of a broken or risky cryptographic algorithm.
Fixes named by IBM:
- 11.0.0: IBM Cognos Controller 11.0.1 FP2 from Fix Central.
- 10.4.2: IBM Cognos Controller 10.4.2 FP3.
- 10.4.1: IBM Cognos Controller 10.4.1 FP1.
- Controller on Cloud 11.x and 10.4.2.x: already updated by IBM.
IBM lists no workarounds. The bulletin was first published on 1 May 2024. IBM and NVD agree on 5.9. The vector is network, high attack complexity, no privileges and no user interaction, with high impact on confidentiality only. The bulletin does not say which algorithm is involved.
Not in CISA's KEV catalog. The bulletin does not say it is exploited in the wild.
How to check if you're exposed
Find your Controller version from the product or your administrators' install records, then compare it with the fixed fix packs above.
Cryptographic weaknesses matter most where encrypted data or traffic can be captured. Ask where Controller traffic travels. Connections that cross untrusted networks, or backups and exports that leave the data centre, deserve attention first, because an attacker needs access to the protected data to try to decrypt it.
What to do now
- Identify each Cognos Controller instance and its version.
- Apply the matching fix pack from IBM Fix Central.
- Confirm that connections to Controller use TLS and that your TLS settings disable outdated protocol versions and ciphers.
- Review where exports and backups of Controller data are stored and who can read them.
- Record the fix level and note that the same bulletin resolves CVE-2023-40695.
Why it matters
Weak cryptography fails quietly. The data looks protected, but the algorithm, key size or mode no longer withstands a determined attacker. The result is a confidentiality loss that nobody sees at the time it happens.
The score is lower than many entries because the attack is rated high complexity and affects confidentiality only. For finance applications that still counts, since consolidation data can be material. The IBM bulletin does not give algorithm detail, so treat the fix pack as the answer and avoid guessing at what is weak.
Quick check
Which algorithm is weak?
IBM's bulletin does not say. It describes weaker than expected cryptographic algorithms and points to the fix packs.
Is this exploitable without an account?
The vector lists no privileges required, but it also rates attack complexity as high, so it is not a trivial attack.
Sources
- IBM security bulletin for IBM Controller
- IBM X-Force entry 264939
- Safeguard Gold entry for CVE-2023-40696
Last reviewed: 19 October 2026.
