CVE-2026-10523

critical

Description

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

References

References
More

https://www.darkreading.com/vulnerabilities-threats/max-severity-ivanti-sentry-flaw-exploited-24-hours

https://arcticwolf.com/resources/blog/ivanti-sentry-critical-vulnerabilities-cve-2026-10520-and-cve-2026-10523-require-urgent-patching/

https://www.theregister.com/patches/2026/06/10/ivanti-urges-sentry-users-to-patch-two-critical-bugs/5253428

https://www.securityweek.com/critical-vulnerabilities-patched-in-fortinet-ivanti-products/

https://www.helpnetsecurity.com/2026/06/10/ivanti-sentry-cve-2026-10520-cve-2026-10523/

https://www.bleepingcomputer.com/news/security/new-max-severity-ivanti-sentry-flaw-allows-code-execution-as-root/

https://thehackernews.com/2026/06/ivanti-fortinet-and-sap-release-patches.html

https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

https://github.com/imbas007/RCE-CVE-2026-10520-CVE-2026-10523

https://github.com/gagaltotal/CVE-2026-10523-Ivanti-sentry

https://github.com/0xBlackash/CVE-2026-10520

https://github.com/HORKimhab/CVE-2026-10520-10523

https://github.com/ogenich/CVE-2026-10520

https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523

https://github.com/intelseclab/poc-archive

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US

Details

Source: Mitre, NVD

Published: 2026-06-09

Updated: 2026-07-23

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H