---
title: "CVE-2026-10523: ivanti Sentry vulnerability"
url: https://erroneo.us/security/cve/CVE-2026-10523/
description: "CVE-2026-10523 (ivanti Sentry): An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-09
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-10523"
kev: false
cvss: 9.9
epss: 0.53136
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-10523: ivanti Sentry vulnerability

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 53.1% , percentile 99: FIRST’s model estimates a 53.1% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Editorial verdict: Check exposure. Ivanti Sentry CVE-2026-10520: Pre-Auth Root RCE — Fixed since June 2026, and exploited within two days of a public PoC. Confirm every Sentry runs R10.5.2, R10.6.2, R10.7.1 or later and that port 8443 is not internet-facing. Treat any appliance that was exposed and unpatched as compromised.

## What it is

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

## Affected products (CVE record)

- ivanti Sentry: see advisory

## Severity

- ivanti CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-23): 53.14% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [CVE.org record CVE-2026-10523](https://www.cve.org/CVERecord?id=CVE-2026-10523)
- [NVD entry CVE-2026-10523](https://nvd.nist.gov/vuln/detail/CVE-2026-10523)
- [hub.ivanti.com](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US)

---
Source page: https://erroneo.us/security/cve/CVE-2026-10523/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt