CVE-2026-10523: Ivanti Sentry authentication bypass allows admin account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required and full administrative impact, plus a high EPSS score, make this an urgent patch.

What it is

Ivanti Sentry contains an authentication bypass (CWE-288, alternate path) that lets a remote, unauthenticated attacker create arbitrary administrative accounts. Successful exploitation yields full administrative control of the appliance, which is a high-value gateway component. The flaw affects versions before R10.5.2, R10.6.2 and R10.7.1.

Impact

An attacker gains full administrative access to Sentry, including the ability to create and control admin accounts. From there they can alter configuration, access managed data and pivot into connected systems.

Attack surface

Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The alternate-path bypass means the attacker targets a request path that skips the normal authentication check.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is high at 0.5187 (98.9th percentile), indicating elevated near-term exploitation likelihood, and the only reference is the vendor patch advisory.

What to do

• Upgrade Sentry to R10.5.2, R10.6.2 or R10.7.1 as listed in the vendor advisory.
• If immediate patching is not possible, restrict network access to the Sentry management interface to trusted sources only.
• Audit existing Sentry accounts for unauthorized or unexpected administrative accounts and remove them.
• Rotate credentials and review logs for configuration changes made since exposure began.
• Monitor the vendor advisory for updated guidance.

Detection

• Alert on creation of new administrative accounts in Sentry, especially outside change windows.
• Review Sentry and reverse-proxy logs for requests to unusual or alternate paths that bypass normal authentication.
• Baseline and monitor administrative configuration changes on Sentry appliances.
• Correlate Sentry authentication events with source IPs to flag unauthenticated or anomalous access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.