EUVD-2026-35441
GHSA-8fc8-rw5j-9rcq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated admin account creation over the network with no user interaction yields AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the appliance.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Articles & Coverage 4
AnalysisAI
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative control of the appliance. Publicly available exploit code exists (watchTowr Labs PoC chained with CVE-2026-10520 for RCE), though it is not yet listed in CISA KEV; EPSS sits at a modest 0.31% (54th percentile) despite the critical CVSS 9.8 rating.
Technical ContextAI
Ivanti Sentry (formerly MobileIron Sentry) is a gateway appliance that brokers traffic between mobile devices and enterprise backend systems such as ActiveSync, AppTunnel, and Kerberos KDC, typically deployed in conjunction with Ivanti EPMM (Endpoint Manager Mobile). The flaw is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning a request path exists that reaches privileged administrative functionality without traversing the normal authentication checkpoint. The affected CPE cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:* covers all Sentry versions prior to the three patched branches (R10.5.2, R10.6.2, R10.7.1), and the public watchTowr research suggests the bypass is reachable via the appliance's management interface where account-creation logic is exposed without proper authorization.
RemediationAI
Vendor-released patch: upgrade to Ivanti Sentry R10.5.2, R10.6.2, or R10.7.1 (whichever corresponds to your current branch) per the Ivanti advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523. Until the patch is applied, restrict network exposure of the Sentry management interface (port 8443/HTTPS admin portal) to a dedicated management VLAN or jump-host source IPs via firewall ACLs - this materially reduces the unauthenticated remote attack surface but will break legitimate admin workflows from arbitrary networks; do NOT rely on disabling the admin interface entirely as it is required for normal Sentry operation. Additionally, audit administrative account lists for unexpected new accounts created prior to patching, as account creation is the documented impact, and rotate credentials for any pre-existing admin accounts after patching as a precaution.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to a
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
Sentry is an error tracking and performance monitoring platform. Rated high severity (CVSS 8.1), this vulnerability is r
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauth
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Rated medium severity (CVSS 5.3
SAML authentication bypass in Sentry 21.12.0 through 26.1.0.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1
Denial of service in Sentry's self-hosted/SaaS event ingestion pipeline (versions 24.4.0 through 26.5.1) lets remote act
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today