Executive brief
Ivanti Sentry is a gateway appliance used to manage and secure traffic between mobile devices and backend enterprise systems. A critical security flaw allows an unauthenticated attacker to bypass security controls and create new administrative accounts. This gives the attacker full control over the appliance, potentially allowing them to intercept sensitive data or disrupt corporate mobile communications.
Technical details
An authentication bypass vulnerability (CWE-288) exists in Ivanti Sentry due to the presence of an alternate path or channel that does not properly enforce authentication. A remote, unauthenticated attacker can exploit this flaw to create arbitrary administrative accounts, leading to full administrative access to the appliance. The vulnerability affects Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. While the CVSS vector provided by the vendor (PR:L) suggests low privileges are required, the description explicitly states the flaw is accessible to unauthenticated attackers. Patches are available in versions R10.5.2, R10.6.2, R10.7.1, and subsequent releases.
Affected products
- Ivanti Sentry Before R10.5.2, R10.6.2, and R10.7.1
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory