CVE-2026-10523: An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10

Synopsis

An authentication bypass vulnerability (CWE-288) affects Ivanti Sentry before versions R10.5.2, R10.6.2, and R10.7.1. The flaw is reachable over the network and requires no authentication, meaning any remote attacker with access to the service can exploit it without credentials. Successful exploitation lets an attacker create arbitrary administrative accounts and gain full administrative control over the affected Sentry instance. Patched-image rebuilds at versions R10.5.2, R10.6.2, and R10.7.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ivanti Sentry service over the network; the vulnerability is exposed to any host with network access to the target.

• AuthenticationNot required

  No credentials or prior account are needed; the bypass allows a completely unauthenticated remote attacker to interact with the administrative interface.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker creates arbitrary administrative accounts on the Sentry instance, establishing persistent privileged access.
• Full administrative control is obtained, allowing the attacker to read all configuration data, credentials, and proxied mobile device traffic flowing through Sentry.
• The attacker can modify Sentry policies, gateway rules, and user access controls, corrupting the security posture for all managed devices.
• Administrative access enables the attacker to disable or crash the Sentry service, disrupting mobile device management connectivity for all enrolled endpoints.