CVE-2026-10523

CVE-2026-10523 is an authentication bypass (CWE-288) in Ivanti Sentry, the gateway component formerly known as MobileIron Sentry, affecting standalone deployments before the R10.5.2, R10.6.2, and R10.7.1 releases. A remote, unauthenticated attacker can exploit it over the network with no credentials, no user interaction, and no special conditions, creating arbitrary administrative accounts on the affected gateway. The attacker thereby obtains full administrative control of Sentry, which in most deployments sits at the network edge handling mobile-device (MDM/UEM) traffic for organizations using Ivanti's mobility management stack. Any organization running an affected standalone Sentry version is exposed, with internet-facing instances at greatest risk. Exploitation has not yet been confirmed in the wild (no public PoC, not in CISA KEV), but the high EPSS score of 51.9% (99th percentile) indicates a strong likelihood of exploitation within the next 30 days.

What to do: Upgrade standalone Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 depending on your current release branch. Until patched, restrict network exposure of Sentry (especially direct internet access) and review the administrative account list for unexpected admin accounts created without authorization. Given the critical severity and high EPSS, prioritize patching internet-facing instances first.