Administration Runtime Expert for i CVE-2026-17203

The CVE description states the attacker must be 'remote' and 'authenticated,' implying at minimum a valid credential to the IBM i system or the Administration Runtime Expert for i service is required. However, the CVSS vector specifies PR:N (no privileges required), which directly contradicts this - IBM or NVD may have miscoded PR, and the true requirement may be PR:L. The flaw is triggered by accessing specific service endpoints where authentication enforcement is improperly implemented; no specific non-default configuration trigger is identified in available data. Exploitation is limited to: environments running IBM Administration Runtime Expert for i 1R1M0, network reachability to the service, and at minimum some form of system access (the exact credential level is unconfirmed due to the PR:N vs. 'authenticated attacker' conflict). Impact is confidentiality only - no write or service disruption path identified.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) presents a significant internal contradiction: PR:N indicates no privileges are required, yet the CVE description explicitly states the attacker must be 'remote authenticated.' These two signals conflict and the discrepancy must be verified with IBM's advisory. If PR:N is correct, exploitation is unauthenticated and the real-world risk is meaningfully higher than if PR:L applies. EPSS data is not provided. The vulnerability is not listed in CISA KEV, and no POC has been identified, which reduces urgency somewhat. However, confidentiality impact is rated High, meaning successful exploitation could expose significant sensitive administrative data in IBM i environments. IBM i is a specialized platform used in banking, manufacturing, and government sectors - exposure of administrative runtime data in those contexts may have outsized downstream risk. IBM has released a patch, which is the primary risk control.

An attacker with at minimum a low-privilege authenticated session (or possibly no credentials, per the CVSS PR:N - see confidence notes) sends crafted network requests to the Administration Runtime Expert for i service, targeting endpoints that improperly enforce authentication. The service returns sensitive administrative or system configuration data that the attacker's authentication level should not authorize. No public POC exists, but the low attack complexity (AC:L) suggests that once the vulnerable endpoint is identified, exploitation requires no special tooling.