CVE-2026-10523
CRITICALIvanti Sentry - Authentication Bypass Using an Alternate Path or Channel
Title source: ruleExploitation Summary
EIP tracks 3 public exploits for CVE-2026-10523. PoCs published by watchtowrlabs, gagaltotal, HORKimhab.
AI-analyzed exploit summary This repository contains a functional Python script that exploits CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry, demonstrating an authentication bypass and remote code execution vulnerability. The script sends a crafted request to execute system commands and extracts the output, confirming exploitation.
Description
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Exploits (3)
This repository contains a functional Python script that exploits CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry, demonstrating an authentication bypass and remote code execution vulnerability. The script sends a crafted request to execute system commands and extracts the output, confirming exploitation.
The repository contains only a minimal README with the CVE identifier and a brief mention of Ivanti Sentry, lacking any exploit code, technical details, or meaningful content.
The repository contains functional exploit code for CVE-2026-10520, targeting Ivanti Sentry. The PoC demonstrates command execution via a crafted POST request to the vulnerable endpoint, with both single-target and mass-scanning capabilities.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H