Ivanti Sentry CVE-2026-10523: Quick Look at a CVSS 9.9 Authentication Bypass Enabling Full Admin Takeover

Introduction

A remote unauthenticated attacker can create arbitrary administrative accounts on Ivanti Sentry systems running versions prior to R10.5.2, R10.6.2, and R10.7.1. That grants complete control over the gateway and all the mobile enterprise traffic it manages. CVE-2026-10523 carries a CVSS score of 9.9, and its structural twin, CVE-2023-38035, was actively exploited in the wild and landed on the CISA Known Exploited Vulnerabilities catalog. Any organization running Ivanti Sentry should give it immediate attention.

Ivanti Sentry (formerly MobileIron Sentry) is an in-line gateway that manages, encrypts, and secures traffic between mobile devices and back-end enterprise systems such as email, calendar, and contacts servers. It is a core component of the Ivanti Unified Endpoint Management (UEM) platform, widely deployed across enterprises and government agencies to enforce mobile security policies. Because it sits between endpoints and corporate resources, a compromised Sentry is a particularly consequential target.

Technical Information

Root Cause: CWE-288 Authentication Bypass Using an Alternate Path or Channel

CVE-2026-10523 is classified under CWE-288. The weakness describes a product that correctly requires authentication for a resource on its primary interface but exposes an alternate path or channel that does not enforce it. According to the MITRE CWE definition, the alternate route may be a different URL, API endpoint, hardware register, or communication channel that lets an attacker bypass intended access controls entirely.

In the CWE hierarchy, CWE-288 is a child of CWE-306 (Missing Authentication for Critical Function) and a parent of CWE-425 (Direct Request / Forced Browsing) and CWE-1299 (Missing Protection Mechanism for Alternate Hardware Interface). It overlaps with CWE-420 (Unprotected Alternate Channel), though the two differ in their focus on path versus channel. Authentication bypass of this type often comes from architectural or design flaws, such as assuming a front-end screen is the only entry point when back-end programs or debugging interfaces remain directly accessible.

The NVD description for CVE-2026-10523 states: an Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. The NVD has not yet provided its own CVSS assessment. The 9.9 score comes from the CNA (Ivanti itself).

Attack Flow

Based on the CVE description and the CWE-288 classification, exploitation follows a well-understood pattern:

1. The attacker identifies a network-accessible Ivanti Sentry instance. Because Sentry is a gateway, these systems often have network interfaces reachable from external or semi-trusted network segments.

2. The attacker discovers an administrative path, likely an API endpoint or internal script, that does not enforce the same authentication controls as the primary administrator login interface. A common CWE-288 exploitation pattern is a direct request to an internal script or API: the attacker skips the web application's login page and requests an administrative URL that was never meant to be publicly reachable.

3. Through this unprotected path, the attacker creates one or more arbitrary administrative accounts without providing any credentials.

4. With valid administrative credentials now in hand, the attacker logs into the Sentry management interface through normal channels and has complete control over the gateway.

5. An attacker with administrative access to Ivanti Sentry can monitor, intercept, and manipulate all mobile traffic passing through the gateway, which potentially exposes corporate email, calendar, contacts, and other sensitive data. The compromised Sentry system is also a pivot point for lateral movement into the broader corporate network.

The CVE-2023-38035 Precedent

The most directly analogous vulnerability is CVE-2023-38035, an API Authentication Bypass on the Ivanti Sentry Administrator Interface disclosed in August 2023. It affected Ivanti Sentry versions 9.18 and above and was also classified as an authentication bypass affecting the System Manager Portal.

Horizon3 AI's deep-dive analysis of CVE-2023-38035 showed that the vulnerability let an unauthenticated attacker bypass authentication on the Sentry administrator API interface. The exploit accessed API endpoints directly. Those endpoints should have required authentication but did not enforce it, so the attacker could perform administrative actions without credentials.

Darktrace observed real-world exploitation of CVE-2023-38035 in customer environments. After exploitation, attackers performed reconnaissance and moved laterally within the network. The attack was detected through anomalous behavior on the compromised Sentry appliance, including unusual external connections and internal scanning activity.

CVE-2023-38035 and CVE-2026-10523 share the same structure. Both are CWE-288 authentication bypasses in Ivanti Sentry, both require no authentication, and both target the administrative interface. The same vulnerability class turning up in the same product roughly three years apart points to persistent architectural issues in how Sentry implements authentication boundaries.

Companion Vulnerability: CVE-2026-10520

The official Ivanti advisory URL references both CVE-2026-10523 and CVE-2026-10520, so two Sentry vulnerabilities were addressed in the same security update. Specific details about CVE-2026-10520 were not available from the advisory page at the time of this analysis. Organizations should treat both CVEs as critical and apply the patched versions, which address both at once.

Impact Assessment

Three factors push the impact of CVE-2026-10523 to the maximum. Exploitation requires no authentication, the attack runs remotely over the network, and success grants full administrative control, including the ability to create persistent backdoor accounts. No user interaction is required either, so exploitation can be fully automated.

The critical difference between CVE-2026-10523 and CVE-2026-6973 is authentication. CVE-2026-10523 requires no credentials at all, while CVE-2026-6973 requires an authenticated admin user. That makes CVE-2026-10523 significantly more dangerous as an initial access vector.

Affected Systems and Versions

The following Ivanti Sentry versions are vulnerable:

Any Ivanti Sentry release earlier than the fixed version on its branch is affected. The vulnerability is exploitable remotely without authentication, so any Sentry instance with network-reachable administrative interfaces is at risk.

Recommended Mitigations

Organizations should upgrade to the appropriate fixed version immediately. Until patching is complete, apply these compensating controls:

Network segmentation: Restrict network access to Ivanti Sentry administrative interfaces. Place Sentry management ports behind firewalls and allow access only from authorized administrative VLANs or IP ranges.

Eliminate internet-facing exposure: If Ivanti Sentry administrative interfaces are exposed to the internet, restrict access to trusted internal networks immediately. The similar CVE-2023-38035 was exploited through internet-facing Sentry instances.

Audit administrative accounts: Check every current administrative account on Sentry systems for legitimacy and remove any unauthorized accounts that may have been created through exploitation. Keep monitoring for anomalous account creation after that.

Post-patch verification: After applying the update, confirm that the Sentry version matches one of the fixed releases, audit every administrative account created before the patch was applied, and review Sentry logs for any evidence of unauthorized administrative activity.

The MITRE CWE-288 guidance gives two architectural mitigations for this class of vulnerability. First, funnel all access through a single choke point, so every request to a protected resource passes through one centralized authentication and authorization gateway. Second, perform the same permission check on every access, whatever the entry point, and validate the user's identity and rights before granting access.

Vendor Security History

Ivanti has a significant, recurring pattern of critical security vulnerabilities across its product line, and CWE-288 authentication bypasses are a repeat entry.

CISA Advisory AA25-022A documents how threat actors chained vulnerabilities in Ivanti Cloud Service products. Based on evidence of active exploitation, CISA noted that "these vulnerabilities were exploited as zero days." Ivanti products have appeared repeatedly in the CISA Known Exploited Vulnerabilities catalog, which puts federal agencies on mandatory patching deadlines.

CWE-288 has recurred across Ivanti's product line: Sentry in 2023, Neurons for ITSM in 2025, and Sentry again in 2026. That recurrence reveals a systemic architectural failure in how Ivanti implements authentication boundaries. The two MITRE CWE-288 mitigations, a single choke point for all access and a check on every access, appear not to have been applied consistently across Ivanti's codebase, despite prior vulnerabilities of this exact type. The pattern suggests that organizations should not rely on Ivanti's patching cadence alone. They should add defense-in-depth controls, including network segmentation, continuous monitoring, and reduced internet-facing exposure of Ivanti management interfaces.

References

• NVD: CVE-2026-10523
• Ivanti Security Advisory: Ivanti Sentry CVE-2026-10520 and CVE-2026-10523
• MITRE CWE-288: Authentication Bypass Using an Alternate Path or Channel
• Ivanti Sentry Product Page
• Ivanti Advisory: CVE-2023-38035 API Authentication Bypass on Sentry Administrator Interface
• Horizon3 AI: Ivanti Sentry Authentication Bypass CVE-2023-38035 Deep Dive
• Darktrace: Entry via Sentry, Analyzing the Exploitation of a Critical Vulnerability in Ivanti Sentry
• CISA Known Exploited Vulnerabilities Catalog
• CISA Advisory AA25-022A: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service
• BleepingComputer: Ivanti Warns of Two EPMM Flaws Exploited in Zero Day Attacks
• The Hacker News: Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation
• ZeroPath: Ivanti Neurons for ITSM CVE-2025-22462 Auth Bypass
• Huntress: Ivanti Mass Zero Day Exploits Data Breach
• runZero: Ivanti Gateway Vuln CVE-2025-22457, How to Find Affected Systems
• SentinelOne: What Is Authentication Bypass? Techniques and Examples