EUVD-2026-67950
GHSA-rg54-x42p-hp27
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Session fixation needs a privileged victim to authenticate into the attacker's session, so AC:H and UI:R; no attacker credentials per description gives PR:N, and hijacked admin profile yields full C/I/A with scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.
AnalysisAI
Privilege escalation via session fixation in IBM Administration Runtime Expert (ARE) for i, version 1R1M0, lets a remote attacker cause actions to run under another user's authenticated profile through flawed handling in the ARE GUI component, yielding elevated privileges on the IBM i host. The description characterizes the attacker as unauthenticated, though the CVSS 3.1 vector (PR:L) implies some low-privilege foothold - this signal conflict should be confirmed with IBM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the ARE GUI component of IBM Administration Runtime Expert for i 1R1M0 and hinges on session fixation: the attacker must be able to reach the ARE web GUI over the network and cause a target user to authenticate into a session identifier the attacker controls or can reuse. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly weighted toward high priority but internally inconsistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - apply the IBM-provided fix (PTF) for Administration Runtime Expert for i as documented at https://www.ibm.com/support/pages/node/7284580; the reference is a support page rather than an explicit version string, so confirm the exact PTF level for your IBM i release directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all IBM i systems running ARE version 1R1M0, obtain the vendor patch from IBM, and clarify with IBM whether this vulnerability requires existing low-privilege access or affects unauthenticated users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today