Ivanti Sentry CVE-2026-10523

No special conditions - remote unauthenticated exploitation against default configurations of Ivanti Sentry running any version prior to R10.5.2, R10.6.2, or R10.7.1, requiring only network reachability to the Sentry administrative HTTPS interface. The only realistic limiting factor is network exposure: if the admin portal is firewalled off from the internet and restricted to a management network, the attacker must already have a foothold on that segment; no user interaction, no authentication, and no non-default configuration is required.

All signals converge on this being a high-priority issue for any organization running Sentry: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation, SSVC technical impact is 'total,' and a working PoC exists chained with CVE-2026-10520 for full RCE. The countervailing signals are that SSVC exploitation is marked 'none' (no confirmed in-the-wild activity), Automatable is 'no,' EPSS is only 0.31% (54th percentile), and the vulnerability is not in CISA KEV - suggesting that despite the public exploit, broad opportunistic exploitation has not yet materialized. Given Ivanti's historical pattern of post-disclosure mass-exploitation (e.g., prior Sentry, EPMM, and Connect Secure CVEs), the gap between 'PoC public' and 'actively exploited' is likely to close quickly, so the low EPSS should be treated as a lagging indicator rather than a reason to deprioritize.

An external attacker scans for internet-exposed Ivanti Sentry admin interfaces, then sends a crafted unauthenticated HTTP request to the vulnerable endpoint that bypasses authentication and creates a new administrator account. Using those credentials (and the chained CVE-2026-10520 from the public watchTowr PoC), the attacker logs into the admin console and pivots to remote code execution on the Sentry appliance, which sits in a privileged position between mobile fleet and enterprise backend services. This is realistic today because exploit code is publicly available on GitHub and the attack vector is AV:N/AC:L/PR:N/UI:N.