CVE-2026-83527

CVE-2026-83527 is an authentication bypass (CWE-288) in Ivanti Sentry that allows a remote, unauthenticated attacker to gain administrative-level access to the appliance. It is triggered over the network with no prior privileges or user interaction, though the high-attack-complexity (AC:H) CVSS rating indicates exploitation depends on specific conditions rather than a trivially reliable path. A successful attacker obtains admin-level control of Sentry, the gateway component many organizations deploy alongside Ivanti EPMM/MobileIron for mobile device management, potentially exposing or disrupting device-management functions. Any organization running Ivanti Sentry on builds earlier than the fixed releases R10.8.2, R10.7.3, or R10.6.4 (depending on release line) is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS assigns a 1.5% probability of exploitation within 30 days, so active exploitation is not currently confirmed.

What to do: Upgrade Ivanti Sentry to R10.8.2 (or R10.7.3 / R10.6.4 for the corresponding release line) as addressed in Ivanti's advisory AV26-897. Until patched, minimize Sentry's internet exposure to required management/enrollment traffic and review appliance logs for unexpected administrator logins. Ivanti EPMM and Neurons for ITSM administrators should also review the same advisory, which covers additional flaws in those products.