EUVD-2026-35441
GHSA-8fc8-rw5j-9rcq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Articles & Coverage 4
AnalysisAI
Authentication bypass in Ivanti Sentry prior to R10.5.2, R10.6.2, and R10.7.1 allows remote attackers to create arbitrary administrative accounts and gain full admin control of the mobile management gateway. The flaw is rated CVSS 9.9 with a scope-changed vector, indicating compromise extends beyond the immediate vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network reachability to the Ivanti Sentry administrative interface (the management port, typically TCP 8443, rather than the device-facing data port) on a Sentry instance running any build older than R10.5.2, R10.6.2, or R10.7.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are strongly aligned toward high real-world risk: CVSS 9.9 with AV:N/AC:L, scope-changed (S:C), and full CIA impact reflects trivial network exploitation that escalates beyond Sentry itself into the managed mobile/email infrastructure it fronts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Sentry management interface over the network sends a crafted request to the affected admin endpoint that bypasses authentication, then invokes the account-creation function to add a new administrator with a chosen password. They log in as that administrator, reconfigure tunneling/Kerberos settings or extract credentials, and pivot into the Exchange/ActiveSync infrastructure Sentry fronts. … |
| Remediation | Vendor-released patches: upgrade to Ivanti Sentry R10.5.2, R10.6.2, or R10.7.1 on the matching maintenance branch per the advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Ivanti Sentry deployments; assess network exposure; enable enhanced logging for administrative account creation activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today