IBM Cognos Command Center 10.2.4.1 and 10.2.5 contain a cross‑site request forgery flaw that allows a remote attacker to trigger execution of arbitrary processes through the web interface. The vulnerability can lead to unauthorized process creation, potentially providing the attacker with the same privileges as that of the authenticated user and thus enabling remote code execution. The identified weakness aligns with CWE‑352, which denotes Cross‑Site Request Forgery, and the CVSS score of 4.3 indicates a moderate severity.

Affected products are IBM Cognos Command Center for the 10.2.4.1 and 10.2.5 releases, including 10.2.5 FP1 IF4 and IF5 and 10.2.5 FP1 IF5 as mentioned. IBM has released fixed updates for both versions, available for download from IBM support. Administrators should verify that their installations are not running these vulnerable releases and upgrade to the latest fixed point release.

With a CVSS score of 4.3 the risk is moderate, and the vulnerability is not currently listed in the CISA KEV catalog. No EPSS score is available, so the likelihood of exploitation is uncertain. The gap is exploitable via CSRF attacks; a malicious site or script can subvert an authenticated user's session to trigger the process creation endpoint. The impact potentially escalates to full remote code execution if the user has sufficient privileges. Prompt patching is therefore advised, as the patch directly addresses the underlying CSRF vulnerability.