# CVE-2026-10523: Ivanti Sentry authentication bypass in administrative interface

Source: https://junglewise.ai/threats/cve-2026-10523-ivanti-sentry-authentication-bypass-in-administrative-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-10523 · Severity: critical · CVSS 9.9 · Published 2026-06-09

Ivanti Sentry is a gateway appliance used to manage and secure traffic between mobile devices and backend enterprise systems. A critical security flaw allows an unauthenticated attacker to bypass security controls and create new administrative accounts. This gives the attacker full control over the appliance, potentially allowing them to intercept sensitive data or disrupt corporate mobile communications.

Technologies: [Ivanti Sentry](https://junglewise.ai/threats/technologies/sentry). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-10523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10523 being exploited in the wild.

**How severe is CVE-2026-10523?** Critical severity, with a CVSS score of 9.9, published 9 June 2026.

**Which products and versions are affected?** Ivanti Sentry Before R10.5.2, R10.6.2, and R10.7.1.

**Is there a fix for CVE-2026-10523?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10523 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10523?** Check whether you run Ivanti Sentry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability (CWE-288) exists in Ivanti Sentry due to the presence of an alternate path or channel that does not properly enforce authentication. A remote, unauthenticated attacker can exploit this flaw to create arbitrary administrative accounts, leading to full administrative access to the appliance. The vulnerability affects Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. While the CVSS vector provided by the vendor (PR:L) suggests low privileges are required, the description explicitly states the flaw is accessible to unauthenticated attackers. Patches are available in versions R10.5.2, R10.6.2, R10.7.1, and subsequent releases.

## Affected products

- Ivanti Sentry Before R10.5.2, R10.6.2, and R10.7.1

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory

## References

- [https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US)

## Related threats

- [Ivanti Sentry path traversal in administrative interface](https://junglewise.ai/threats/cve-2026-123181-a-path-traversal-vulnerability-in-ivanti-sentry-before-versions)
- [Ivanti Sentry insecure resource initialization in Tomcat shutdown listener](https://junglewise.ai/threats/cve-2026-123179-an-insecure-default-initialization-of-resource-in-the-tomcat)
- [Ivanti Sentry argument injection vulnerability](https://junglewise.ai/threats/cve-2026-105669-argument-injection-in-ivanti-sentry-before-version-10-8-3-and-10)
- [Ivanti Sentry and EPMM OS command injection](https://junglewise.ai/threats/cve-2026-105425-os-command-injection-in-ivanti-sentry-before-versions-10-7-4-10)
- [Ivanti Sentry authentication bypass](https://junglewise.ai/threats/cve-2026-83527-ivanti-sentry-authentication-bypass)