Auth Bypass in Ivanti Sentry <10.5.2/10.6.2/10.7.1 Enables Remote Admin Creation
CVE-2026-10523 Published on June 9, 2026
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Vulnerability Analysis
CVE-2026-10523 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected Versions
ivanti Sentry:- Version R10.5.2 is unaffected.
- Version R10.6.2 is unaffected.
- Version R10.7.1 is unaffected.