EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in Ivanti Sentry gateway appliances, affecting versions 10.5.0, 10.6.0, and 10.7.0. The flaws include a remote code execution (RCE) via OS command injection and an authentication bypass that enables arbitrary account creation, both of which can be exploited by unauthenticated attackers over the network. Successful exploitation grants attackers full administrative control over the gateway, allowing them to manipulate traffic, exfiltrate data, or disrupt critical services. For organizations that rely on these appliances to secure corporate traffic, the risk is a complete compromise of perimeter defenses and potential widespread operational impact.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple security vulnerabilities have been identified in Ivanti Sentry gateway appliances, affecting versions 10.5.0, 10.6.0, and 10.7.0. The flaws include a remote code execution (RCE) via OS command injection and an authentication bypass that enables arbitrary account creation, both of which can be exploited by unauthenticated attackers over the network. Successful exploitation grants attackers full administrative control over the gateway, allowing them to manipulate traffic, exfiltrate data, or disrupt critical services. For organizations that rely on these appliances to secure corporate traffic, the risk is a complete compromise of perimeter defenses and potential widespread operational impact.[emaillocker id="1283"]
• CVE-2026-10520 with a CVSS score of 10 – An OS command injection flaw that permits a remote unauthenticated attacker to execute arbitrary system commands with root privileges; exploitation requires only network access to the vulnerable endpoint.
• CVE-2026-10523 with a CVSS score of 9.9 – An authentication bypass that allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access; the attack vector is similarly limited to network connectivity.
The combined vulnerabilities present an urgent, high‑impact threat that could lead to full takeover of critical gateway infrastructure. If exploited, enterprises face loss of data confidentiality, disruption of network services, and erosion of trust in their security perimeter. Immediate attention is required to assess exposure and protect business continuity.
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://securityonline.info/ivanti-sentry-rce-poc-disclosed/