{"id":"CVE-2026-10523","aliases":["EUVD-2026-35441","GHSA-8fc8-rw5j-9rcq"],"status":"published","title":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and...","description":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.53964,"percentile":0.99017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2026-06-09T14:16:41Z","modified":"2026-07-23T08:10:00Z","exploits":[{"source":"pocgithub","id":"gagaltotal/CVE-2026-10523-Ivanti-sentry","title":"gagaltotal/CVE-2026-10523-Ivanti-sentry","date":"2026-06-19","url":"https://github.com/gagaltotal/CVE-2026-10523-Ivanti-sentry"}],"products":[{"vendor":"ivanti","product":"sentry"},{"vendor":"ivanti","product":"standalone_sentry"},{"vendor":"sentry","product":"sentry"}],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US","tags":["Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10523"},{"url":"https://github.com/advisories/GHSA-8fc8-rw5j-9rcq"}],"sources":{"cve":[{"id":"CVE-2026-10523","description":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access","status":"published","published":"2026-06-09T14:16:41.255Z","modified":"2026-06-10T03:58:55.72Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-35441","description":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access","status":"published","published":"2026-06-09T14:16:41Z","modified":"2026-06-10T03:58:55Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:45.803611Z"}],"ghsa":[{"id":"GHSA-8fc8-rw5j-9rcq","title":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and...","description":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access","status":"published","published":"2026-06-09T18:30:38Z","modified":"2026-06-09T18:30:39Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:08:40.95868Z"}],"nvd":[{"id":"CVE-2026-10523","description":"An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access","status":"published","published":"2026-06-09T16:16:35.837Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:23.109705Z"}]}}