Administration Runtime Expert CVE-2026-18527

Exploitation targets the ARE GUI component of IBM Administration Runtime Expert for i 1R1M0 and hinges on session fixation: the attacker must be able to reach the ARE web GUI over the network and cause a target user to authenticate into a session identifier the attacker controls or can reuse. The realistic limiting factor - inherent to CWE-384 - is that a legitimate, higher-privileged user must authenticate into the fixed/attacker-known session for privilege gain to occur; the elevated privileges obtained mirror that victim's profile. The description labels the attacker unauthenticated, but the supplied CVSS vector specifies PR:L, so whether any prior foothold is needed is not confirmed from available data and should be verified with IBM. Reachability of the ARE GUI (network exposure) is the primary configuration-dependent prerequisite.

The signals are strongly weighted toward high priority but internally inconsistent. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - network vector, low complexity, changed scope, and total C/I/A impact - which is critical. However, two tensions exist: (1) the vector requires PR:L (some privilege) while the description states an unauthenticated attacker, and (2) session fixation as a class (CWE-384) typically depends on a victim authenticating into a fixed session, which usually implies added complexity and often user interaction not reflected by AC:L/UI:N. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation likelihood cannot be quantified and should not be assumed high despite the 9.9. Net: treat as a high-priority patch given critical impact and network reachability, but recognize the exploitation-condition uncertainty means the practical bar is likely higher than the raw score suggests. Verify the auth-requirement discrepancy with IBM before deprioritizing or over-escalating.

An attacker with network reach to the ARE GUI plants or predetermines a session identifier, then induces or waits for a privileged IBM i administrator to authenticate into that fixed session. Once the operator logs in, the attacker reuses the same session token to issue ARE actions under the victim's authenticated, elevated profile, effectively taking over administrative control of the IBM i system. No public exploit code is known, and the network vector with low stated complexity makes remote attempts feasible where the GUI is exposed.