EUVD-2026-72812
GHSA-2wrg-h4h7-g9f6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible auth bypass granting admin access; AC:H reflects alternate-path discovery requirement; no auth needed, all impacts high.
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
2DescriptionCVE.org
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
AnalysisAI
Authentication bypass in Ivanti Sentry before R10.6.4, R10.7.3, and R10.8.2 allows a remote unauthenticated attacker to gain administrative-level access to the appliance. Rooted in CWE-288 (Authentication Bypass Using an Alternate Path or Channel), the flaw permits circumventing the primary authentication mechanism - likely via an unprotected API endpoint or secondary management interface - without any credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Ivanti Sentry administrative interface - typically the management web portal or an undocumented API endpoint (CWE-288 alternate path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Ivanti Sentry to the patched versions: R10.6.4, R10.7.3, or R10.8.2, depending on the installed release train - these are the vendor-confirmed fixes per the EUVD data and the Ivanti advisory at https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Ivanti Sentry deployments to determine current versions and exposure scope; restrict network access to management interfaces and disable external connectivity if operationally feasible during patch staging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to a
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to c
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
Sentry is an error tracking and performance monitoring platform. Rated high severity (CVSS 8.1), this vulnerability is r
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauth
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Rated medium severity (CVSS 5.3
SAML authentication bypass in Sentry 21.12.0 through 26.1.0.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today