Authentication Bypass in Ivanti Sentry
CVE-2026-10523 is an authentication bypass vulnerability in the Ivanti Sentry authentication subsystem affecting versions prior to R10.5.2, R10.6.2, and R10.7.1. The flaw allows a remote, unauthenticated attacker to bypass normal authentication controls and create arbitrary administrative accounts, resulting in full administrative access to the affected Sentry instance. Public reporting indicates the issue is reachable over the network and does not require user interaction.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small, single-purpose Python proof-of-concept for Ivanti Sentry authentication bypass and remote code execution associated with CVE-2026-10520 and CVE-2026-10523. The repo contains only two files: a README with usage/output examples and one Python script that performs the attack. The script is not part of a larger exploitation framework. The main capability is unauthenticated remote command execution against an Ivanti Sentry target. The operator supplies a base URL and an arbitrary command via --cmd. The script constructs a POST request to the Ivanti Sentry endpoint /mics/api/v2/sentry/mics-config/handleMessage with Content-Type application/x-www-form-urlencoded and a crafted message parameter containing an XML-like commandexec structure. It disables TLS certificate verification, optionally supports an HTTP proxy, and does not follow redirects. After sending the request, the script parses the response body and optionally JSON-decodes it. It checks for success markers ('Message handled successfully' and '<result><success>...') and extracts the command output with a regular expression. If extraction succeeds, it reports the target as vulnerable and prints the returned command output; otherwise it reports the target as not vulnerable. Repository structure is minimal and operational: README.md documents the vulnerability and demonstrates exploitation, while watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523.py is the executable entry point. Although described as a 'Detection Artifact Generator,' the code actively triggers command execution on the target, so it functions as a real exploit/verification tool rather than a passive detector.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical authentication bypass vulnerability in Ivanti Sentry that allows remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative access.
A critical authentication bypass vulnerability in Ivanti Sentry that allows unauthenticated remote attackers to create rogue administrative accounts and gain full administrative access.
A vulnerability addressed by Ivanti in Ivanti Sentry security updates.
An authentication bypass vulnerability in Ivanti Sentry that allows a remote unauthenticated attacker to create arbitrary administrative accounts and gain full administrative access.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.