CVE-2026-17203

IBM Administration Runtime Expert for i at level 1R1M0 fails to properly enforce authentication (CWE-287) on its network-facing interfaces, allowing requests to be handled without the required authorization checks. An attacker reaches the affected service remotely over the network; IBM describes the attacker as authenticated, while the published CVSS 3.1 vector assumes no privileges are required (AV:N/AC:L/PR:N), consistent with a gap in authentication enforcement. A successful attacker can obtain sensitive information from the affected system, with confidentiality impact rated High and no integrity or availability impact. Only environments running Administration Runtime Expert for i 1R1M0 — an IBM i platform component used to capture and compare system configuration data for PTF management — are affected. There is no evidence of exploitation so far: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only about a 0.4% chance of exploitation within 30 days.

What to do: Check whether Administration Runtime Expert for i 1R1M0 is installed on your IBM i systems and whether its web/service interfaces are reachable from untrusted networks. Apply the corrective update or IBM i PTF for Administration Runtime Expert published in IBM's advisory for CVE-2026-17203, and in the interim restrict access to the ARE service to trusted administrator networks. Since this is an information-disclosure flaw with no known exploitation, prioritize exposure review over emergency patching but patch within normal high-severity timelines.