CVE-2026-10523: Ivanti Sentry Auth Bypass Vulnerability

CVE-2026-10523 Overview

CVE-2026-10523 is an authentication bypass vulnerability [CWE-288] in Ivanti Sentry. The flaw allows a remote attacker to create arbitrary administrative accounts and gain full administrative control over affected appliances. Ivanti Sentry versions before R10.5.2, R10.6.2, and R10.7.1 are impacted.

The vulnerability carries a CVSS 3.1 score of 9.9 and is tracked under Ivanti's coordinated advisory covering CVE-2026-10520 and CVE-2026-10523. Successful exploitation grants attackers persistent administrative access to the Sentry management plane, which brokers traffic between mobile devices and enterprise backend systems.

Critical Impact
A remote attacker with low privileges can create administrative accounts and seize full control of Ivanti Sentry, exposing managed mobile traffic, certificates, and backend integrations.

Affected Products

Ivanti Sentry versions prior to R10.5.2
Ivanti Sentry versions prior to R10.6.2
Ivanti Sentry versions prior to R10.7.1

Discovery Timeline

2026-06-09 - CVE-2026-10523 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-10523

Vulnerability Analysis

CVE-2026-10523 is an authentication bypass classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel). The defect resides in the administrative account management logic of Ivanti Sentry, which fails to enforce proper authorization checks before accepting account creation requests over the network.

Ivanti Sentry acts as a policy enforcement gateway for mobile device traffic accessing backend resources such as Microsoft Exchange and corporate file shares. An attacker who gains administrative control inherits visibility into device policies, certificate stores, and downstream service credentials. The advisory states that the attacker does not need valid authentication to invoke the vulnerable path.

Exploitation results in account creation with administrator role assignment. From that position, an adversary can pivot into managed mobile traffic, modify access policies, exfiltrate certificates, or stage further intrusions into connected enterprise services.

Root Cause

The root cause is missing or insufficient authentication enforcement on the administrative account creation channel. The application accepts privileged provisioning requests without validating the caller's identity or authorization context, allowing role assignment to occur outside the intended access control flow.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker sends crafted requests to the Sentry management interface and provisions an administrator account. Once the account exists, the attacker authenticates normally and operates with full administrative privilege. See the Ivanti Security Advisory CVE-2026-10520/23 for vendor-confirmed details.

Detection Methods for CVE-2026-10523

Indicators of Compromise

Unexpected administrator accounts present in the Ivanti Sentry user database that were not provisioned through approved change management.
Authentication events from unfamiliar source IP addresses against the Sentry administrative interface.
Configuration changes to policies, ActiveSync rules, or certificate trust stores outside of scheduled maintenance windows.
New API tokens or session activity tied to recently created accounts.

Detection Strategies

Compare the current administrator account list against a known-good baseline and alert on deltas.
Inspect Sentry audit logs for account creation events that lack a corresponding authenticated administrator session.
Correlate HTTP requests to administrative endpoints with successful account provisioning responses.
Hunt for outbound activity from Sentry hosts to unusual destinations, which may indicate post-exploitation data movement.

Monitoring Recommendations

Forward Ivanti Sentry system and audit logs to a centralized SIEM with retention sufficient for retrospective hunting.
Alert on any privilege role assignment events on Sentry appliances in near real time.
Monitor network flows to and from the Sentry management interface and restrict source addresses where possible.
Track integrity of configuration files and certificate stores on the appliance using file integrity monitoring.

How to Mitigate CVE-2026-10523

Immediate Actions Required

Upgrade Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 or later, depending on the deployed branch.
Audit all administrator accounts on Sentry appliances and remove any that cannot be tied to an authorized change.
Rotate credentials, API tokens, and certificates managed by Sentry if compromise is suspected.
Restrict network exposure of the Sentry administrative interface to trusted management networks only.

Patch Information

Ivanti has released fixed versions in the R10.5.2, R10.6.2, and R10.7.1 releases. Patch details and download links are available in the Ivanti Security Advisory CVE-2026-10520/23. Administrators should validate the upgrade in a staging environment before applying it to production gateways.

Workarounds

Place the Sentry administrative interface behind a VPN or jump host accessible only to a defined management subnet.
Apply firewall rules that block inbound connections to administrative ports from untrusted networks.
Increase audit logging verbosity and review account state daily until patches are applied.
Disable or isolate Sentry instances that cannot be patched promptly.

bash

# Configuration example: restrict access to the Sentry admin interface
# Replace 10.10.20.0/24 with your trusted management subnet
iptables -A INPUT -p tcp --dport 8443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP