CVE-2026-10523 is a critical (CVSS 9.9) authentication bypass in Ivanti Sentry. The record says a remote attacker can create arbitrary administrative accounts and gain full administrative access. Affected releases are those before R10.5.2, R10.6.2 and R10.7.1. Upgrade to the fixed release for your line and review your admin accounts.
What's affected
Per the record, Ivanti Sentry before R10.5.2, R10.6.2 and R10.7.1 is affected. Upgrade to R10.5.2, R10.6.2 or R10.7.1, whichever matches your line.
The vendor advisory also covers CVE-2026-10520. The Ivanti page did not render for us without a browser, so read it directly for details, product scope and any mitigations before you plan the work.
A detail worth reading closely: the description says unauthenticated, while the vector lists low privileges. Do not use that gap as a reason to wait.
How to check if you're exposed
Find the version in the Sentry administration console, or from your appliance inventory. Make a list of every Sentry instance, including test and disaster recovery copies, and note their release line.
Then check the part that matters if you may have been exposed: review the list of administrative accounts for any you do not recognise, and the audit logs for account creation. Compare against your change records.
What to do now
- Upgrade Ivanti Sentry to R10.5.2, R10.6.2 or R10.7.1 as appropriate.
- Read the Ivanti advisory for CVE-2026-10520 and CVE-2026-10523 and apply any mitigation it lists.
- Review all administrator accounts and delete any you cannot account for.
- Restrict the administration interface to a management network if it is reachable more widely.
- Rotate credentials stored on the appliance after the review, and keep an eye on the advisory for updates.
Why it matters
The impact in the record is full administrative access, and the scope is changed, so the damage can reach beyond the appliance itself. The weakness is classed as CWE-288 (authentication bypass using an alternate path or channel): there is a route to the same function that does not check who is calling.
An attack that creates new admin accounts is attractive because it persists. Closing the hole does not remove an account that was already created, which is why the account review step matters as much as the patch.
The record does not carry a KEV flag for this CVE, and it does not report exploitation in the wild.
Quick check
Is it enough to patch?
Patching closes the hole but does not remove accounts already created through it. Review administrators and logs after you upgrade.
Sources
Last reviewed: 19 October 2026.
