CVE-2026-10523

Exploitation likely. EPSS gives it a 53% chance of exploitation in the next 30 days. Fixed versions are out.

CVSS 3.19.9Critical EPSS percentile99th53% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products4 fixed builds listed below

Published 2026-06-09Updated 2026-07-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

ivanti SentryFixed buildsR10.5.2, R10.6.2, R10.7.1Stated by: CVE record
Ivanti Standalone SentryAffected: < 10.5.2Upgrade to: 10.5.2Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your current Ivanti Sentry version in the admin console to see if it's older than R10.5.2, R10.6.2, or R10.7.1.
If you run standalone Sentry, confirm whether it's below version 10.5.2.
Upgrade immediately to R10.5.2, R10.6.2, or R10.7.1 (or 10.5.2 for standalone Sentry), whichever matches your branch.
After upgrading, review the admin account list for any accounts you don't recognize and remove them.
Restrict or firewall off remote access to the Sentry management interface until the upgrade is complete.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

6 publishers

Exploitation reported in the wild
as reported · Oct 8, 2026·Help Net Security summary
Advisory coverage
as reported · Jun 12, 2026·SecurityWeek
Vendor patch released
as reported · Jun 10, 2026·BleepingComputer
Proof-of-concept published
as reported · Jun 10, 2026·Daily CyberSecurity (securityonline.info) summary

Sourced from public security reporting — each date is when it was published, not when it happened. 5 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

In plain language

Written by AI from the record

Ivanti Sentry has a serious flaw that lets an outside attacker create their own admin account without any password, and reports indicate attackers are already using this against unpatched systems — if you run Sentry, treat this as urgent.

CVE-2026-10523 is an unauthenticated authentication-bypass (CWE-288) in Ivanti Sentry that lets a remote attacker forge arbitrary administrative accounts via a flawed auth-check path, granting full administrative control; exploitation is being reported by the ShinyHunters-linked actor UNC6240.

If you're affected

Full admin takeover
Mobile device fleet compromise
Unauthorized access to managed data
Ransomware/data-theft risk
Operational disruption from rogue admin accounts

What is it

Ivanti Sentry manages and secures mobile devices connecting to company systems. This flaw is like a side door into the security guard's office: anyone outside can walk in and hand themselves a master key, becoming an administrator of the whole system without ever proving who they are.

Who is affected

This matters to you if you run Ivanti Sentry (including standalone Sentry deployments) to manage mobile devices or secure email/app access for your organization. The flaw is reachable by anyone who can reach the Sentry management interface over the network, with no login required beforehand.

How urgent is it

Attackers are already reported to be exploiting this flaw in active campaigns, linked to the group UNC6240/ShinyHunters, so this is not a theoretical risk. There is no CISA emergency directive yet, but the combination of no login requirement and active abuse means you should act now rather than wait. Treat this with the same urgency as a confirmed breach-in-progress scenario.

What to do — in detail

Identify all Ivanti Sentry instances (gateway and standalone) and their exact version. 2. For gateway Sentry, target R10.5.2, R10.6.2, or R10.7.1 depending on your current branch; for standalone Sentry, target 10.5.2. 3. Apply Ivanti's patch per the vendor advisory immediately — there is no documented workaround that fully mitigates the authentication bypass, so network-level isolation (restricting management-plane access to trusted IPs/VPN) is only a stopgap, not a substitute for patching. 4. After patching, audit all administrative accounts for ones created outside your known provisioning process, and rotate credentials/API keys if any suspicious accounts are found. 5. Monitor authentication logs and account-creation events on Sentry for anomalies, especially around the time of disclosure. 6. Though not yet in CISA KEV, given active-exploitation reporting (UNC6240), prioritize this as if a KEV deadline applied — patch within days, not weeks.

Technical context

CVSS 9.9 (Critical), AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-exploitable with low complexity and low privileges required, high impact to confidentiality, integrity, and availability, scope changed. Weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), allowing creation of arbitrary admin accounts. Not currently listed in CISA KEV and no public exploit code is on record, but press reporting attributes active exploitation to UNC6240 (associated with ShinyHunters), which per precedence takes priority over the EPSS predicted-likelihood score. Exploit maturity should be treated as active/in-the-wild despite the absence of public PoC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

53% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

14 events over 45 days, from the signal feeds we watch.

2026-07-24EPSS band changemoderate → highepss band change
2026-07-23Patch availablerecord updated
2026-07-17Analysis publishedPatch tonight: CVE-2026-10520 is a CVSS 10 pre-auth root shell on Ivanti Sentry
2026-06-29EPSS band changelow → moderate
2026-06-28EPSS band changelow → moderate
2026-06-27EPSS band changelow → moderate

Affected products

ivanticommercial · USaka ivanti connect secure, avalanche
- SentrySecurity Products
- standalone sentrySecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-288No name in the record

Sources

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Sentry, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account