A critical session fixation vulnerability in IBM Administration Runtime Expert for i allows unauthenticated attackers to execute unauthorized actions with elevated privileges, posing a severe risk to system integrity.

This vulnerability is a session fixation flaw (CWE-384) located within the Application Runtime Expert GUI component. An unauthenticated attacker can manipulate session handling to assume the identity of an authenticated user, thereby gaining unauthorized elevated privileges on the IBM i system.

The potential for unauthorized privilege escalation and session hijacking represents a critical security failure, as it allows attackers to bypass standard access controls. Given the CVSS score of 9.9, this vulnerability could lead to total compromise of the IBM i environment, including data exfiltration, system manipulation, and potential disruption of core business operations.

Immediate Action: Apply the vendor-provided PTF SJ11185 for version 1R1M0 immediately. Note that applying this patch will render the legacy ARE GUI non-functional, which is an intentional security hardening measure.

Proactive Monitoring: Monitor system access logs for anomalous login patterns or unusual session activity associated with the Administration Runtime Expert interface.

Compensating Controls: Restrict network access to the Administration Runtime Expert GUI to trusted IP addresses only, or place the interface behind a Web Application Firewall (WAF) configured to inspect and validate session tokens.

Public Exploit Available: Unknown

The extreme severity of this vulnerability, combined with the ease of exploitation over a network, necessitates an immediate response. Administrators must prioritize the application of PTF SJ11185 to remediate the session fixation risk. If the legacy GUI is not strictly required for business operations, the transition to the patched state should be treated as an urgent infrastructure maintenance task to prevent potential unauthorized access.