CVE-2026-18527
Received
Published: 28 Aug 2026, 20:48
Last modified:28 Aug 2026, 20:48
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.9 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
28 Aug 2026, 20:48
Published
Vulnerability first disclosed
Description
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Techniques & Countermeasures
- CWE-384•Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Affected Systems
- ibm•administration runtime expert for i
1R1M0