CVE-2025-2697 is a High severity (CVSS 7.4) open redirect in IBM Cognos Command Center 10.2.4.1 and 10.2.5. It can be used for phishing. IBM covers it in a security bulletin, so read that for the fix and apply it. Plan the update with your Cognos administrator.
What's affected
Affected, per the record: IBM Cognos Command Center 10.2.4.1 and 10.2.5.
IBM's bulletin for this CVE is titled Multiple vulnerabilities in IBM Cognos Command Center. It also covers a clickjacking issue, CVE-2025-1494, and updates to the Java runtime the product uses. The page I read did not give me the fixed build in a form I could confirm, so check the bulletin itself for the remediation steps and fix package for your release.
If you run an older release that IBM no longer supports, you may need to plan a move to a supported version.
How to check if you're exposed
Identify the version from the product's About dialog or from the installation record in your software inventory. Compare it against the versions in IBM's bulletin.
Open redirects often show up in web logs as requests carrying a full URL in a redirect or return parameter. You can scan your reverse proxy log for them:
grep -iE "(redirect|return|url)=https?" /var/log/nginx/access.log | head -50
The parameter names are examples, so look at how your own deployment uses redirects. A pattern of external targets in those parameters is worth investigating.
If the product sits behind a gateway, ask whether that gateway can block redirects to external hosts for the affected paths as a temporary measure.
What to do now
- Confirm which Cognos Command Center version each server runs.
- Open IBM's security bulletin and follow its remediation instructions for your version.
- Apply the fix in a test environment first, then in production.
- Warn users about links that lead to a login page after an unexpected redirect.
- Use single sign on and phishing resistant authentication where you can, so a spoofed page is less useful.
- Review your Java runtime updates from the same bulletin.
Why it matters
The record lists CWE-601: URL redirection to an untrusted site. An open redirect lets a link on a trusted domain send the visitor to an attacker's domain. The link looks safe because the first part of the address is genuine.
The scope is changed and user interaction is required in the CVSS vector, and the integrity impact is high. That fits a phishing scenario: the victim has to click, and the damage lands outside the vulnerable component. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Open redirects are often dismissed as low value, but they make phishing messages far more convincing. Fixing them is cheap compared with the cost of a credential theft.
Quick check
Does this give an attacker direct access to my server?
The record describes phishing through a redirect, not direct server access. The risk is that users are sent to a convincing fake site.
Where do I find the fix?
In IBM's security bulletin for Cognos Command Center. The page I read did not state the fixed build clearly, so read the remediation section for your version.
Sources
Last reviewed: 19 October 2026.
