CVE-2026-18527 PUBLISHED

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

Assigner: ibm
Reserved: 31.07.2026 Published: 28.08.2026 Updated: 28.08.2026

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	IBM
Product	Administration Runtime Expert for i
Versions	Version 1R1M0 is affected

Solutions

IBM strongly recommends addressing the vulnerability now.

Release5733-ARE PTF Number(s)PTF Download Link(s)V1R1M0

SJ11185

After applying this PTF the legacy ARE GUI is nonfunctional.

https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11185

References

https://www.ibm.com/support/pages/node/7284580

Problem Types

CWE-384 Session Fixation CWE