Search
Find a vulnerability
Search criteria
15 vulnerabilities found for Sentry by Ivanti
CERTFR-2026-AVI-1135
Vulnerability from certfr_avis - Published: 2026-09-09 - Updated: 2026-09-09
De multiples vulnérabilités ont été découvertes dans les produits Ivanti. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que les correctif de sécurité ont été appliqué sur tous les Ivanti Neurons for ITSM (Cloud).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Ivanti | Sentry | Sentry versions R10.7.x antérieures à R10.7.3 | ||
| Ivanti | Sentry | Sentry versions R10.8.x antérieures à R10.8.2 | ||
| Ivanti | Neurons for ITSM (On-Premises) | Neurons for ITSM (On-Premises) version 2025.4 sans le correctif de sécurité de septembre 2026 | ||
| Ivanti | Endpoint Manager Mobile (EPMM) | EPMM versions antérieures à 12.8.0.4 | ||
| Ivanti | Neurons for ITSM (On-Premises) | Neurons for ITSM (On-Premises) version 2025.2 sans le correctif de sécurité de septembre 2026 | ||
| Ivanti | Neurons for ITSM (On-Premises) | Neurons for ITSM (On-Premises) version 2026.1 sans le correctif de sécurité de septembre 2026 | ||
| Ivanti | Sentry | Sentry versions antérieures à R10.6.4 | ||
| Ivanti | Neurons for ITSM (Cloud) | Neurons for ITSM (Cloud) version 2026.2 antérieures à mo2026.2 | ||
| Ivanti | Endpoint Manager Mobile (EPMM) | EPMM versions 12.9.x antérieures à 12.9.0.2 | ||
| Ivanti | Neurons for ITSM (On-Premises) | Neurons for ITSM (On-Premises) version 2025.3 sans le correctif de sécurité de septembre 2026 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Sentry versions R10.7.x ant\u00e9rieures \u00e0 R10.7.3 ",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions R10.8.x ant\u00e9rieures \u00e0 R10.8.2",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons for ITSM (On-Premises) version 2025.4 sans le correctif de s\u00e9curit\u00e9 de septembre 2026",
"product": {
"name": "Neurons for ITSM (On-Premises)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "EPMM versions ant\u00e9rieures \u00e0 12.8.0.4",
"product": {
"name": "Endpoint Manager Mobile (EPMM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons for ITSM (On-Premises) version 2025.2 sans le correctif de s\u00e9curit\u00e9 de septembre 2026",
"product": {
"name": "Neurons for ITSM (On-Premises)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons for ITSM (On-Premises) version 2026.1 sans le correctif de s\u00e9curit\u00e9 de septembre 2026",
"product": {
"name": "Neurons for ITSM (On-Premises)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions ant\u00e9rieures \u00e0 R10.6.4 ",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons for ITSM (Cloud) version 2026.2 ant\u00e9rieures \u00e0 mo2026.2",
"product": {
"name": "Neurons for ITSM (Cloud)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "EPMM versions 12.9.x ant\u00e9rieures \u00e0 12.9.0.2",
"product": {
"name": "Endpoint Manager Mobile (EPMM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons for ITSM (On-Premises) version 2025.3 sans le correctif de s\u00e9curit\u00e9 de septembre 2026",
"product": {
"name": "Neurons for ITSM (On-Premises)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que les correctif de s\u00e9curit\u00e9 ont \u00e9t\u00e9 appliqu\u00e9 sur tous les Ivanti Neurons for ITSM (Cloud).",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-83527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83527"
},
{
"name": "CVE-2026-18851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18851"
}
],
"initial_release_date": "2026-09-09T00:00:00",
"last_revision_date": "2026-09-09T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1135",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ivanti. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Ivanti",
"vendor_advisories": [
{
"published_at": "2026-09-08",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851",
"url": "https://forums.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851"
},
{
"published_at": "2026-09-08",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti september-2026-security-update",
"url": "https://www.ivanti.com/blog/september-2026-security-update"
},
{
"published_at": "2026-09-08",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Sentry-CVE-2026-83527",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527"
},
{
"published_at": "2026-09-08",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs"
}
]
}
CERTFR-2026-AVI-0724
Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10
De multiples vulnérabilités ont été découvertes dans les produits Ivanti. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Ivanti | Endpoint Manager Mobile (EPMM) | EPMM versions antérieures à 12.7.0.2 | ||
| Ivanti | Endpoint Manager Mobile (EPMM) | EPMM versions 12.8.x antérieures à 12.8.0.3 | ||
| Ivanti | Sentry | Sentry versions 10.6.x antérieures à 10.6.2 | ||
| Ivanti | Sentry | Sentry versions 10.7.x antérieures à 10.7.1 | ||
| Ivanti | Endpoint Manager Mobile (EPMM) | EPMM versions 12.9.x antérieures à 12.9.0.1 | ||
| Ivanti | Sentry | Sentry versions antérieures à 10.5.2 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "EPMM versions ant\u00e9rieures \u00e0 12.7.0.2",
"product": {
"name": "Endpoint Manager Mobile (EPMM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "EPMM versions 12.8.x ant\u00e9rieures \u00e0 12.8.0.3",
"product": {
"name": "Endpoint Manager Mobile (EPMM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions 10.6.x ant\u00e9rieures \u00e0 10.6.2",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions 10.7.x ant\u00e9rieures \u00e0 10.7.1",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "EPMM versions 12.9.x ant\u00e9rieures \u00e0 12.9.0.1",
"product": {
"name": "Endpoint Manager Mobile (EPMM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions ant\u00e9rieures \u00e0 10.5.2",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-6973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6973"
},
{
"name": "CVE-2026-10523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10523"
},
{
"name": "CVE-2026-10520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"
},
{
"name": "CVE-2026-10727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10727"
}
],
"initial_release_date": "2026-06-10T00:00:00",
"last_revision_date": "2026-06-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0724",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ivanti. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Ivanti",
"vendor_advisories": [
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727",
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti june-2026-security-update",
"url": "https://www.ivanti.com/blog/june-2026-security-update"
}
]
}
CERTFR-2024-AVI-1058
Vulnerability from certfr_avis - Published: 2024-12-11 - Updated: 2024-12-11
De multiples vulnérabilités ont été découvertes dans les produits Ivanti. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Ivanti | Policy Secure (IPS) | Policy Secure (IPS) versions 22.7R1.x antérieures à 22.7R1.2 | ||
| Ivanti | Sentry | Sentry versions 10.0.x antérieures à 10.0.2 | ||
| Ivanti | Endpoint Manager (EPM) | Endpoint Manager versions 2022 SU6 et antérieures sans le dernier correctif publié par l'éditeur | ||
| Ivanti | Endpoint Manager (EPM) | Endpoint Manager versions 2024 et antérieures sans le dernier correctif publié par l'éditeur | ||
| Ivanti | Desktop and Server Management (DSM) | Desktop and Server Management (DSM) versions 2024.2 antérieures à 2024.3.5740 | ||
| Ivanti | Sentry | Sentry versions 10.1.x antérieures à 10.1.0 | ||
| Ivanti | Cloud Service Appliance (CSA) | Ivanti Cloud Services Application (CSA) versions 5.0.x antérieures à 5.0.3 | ||
| Ivanti | Connect Secure (ICS) | Connect Secure (ICS) versions 22.7R2.x antérieures à 22.7R2.4 | ||
| Ivanti | Sentry | Sentry versions 9.20.x antérieures à 9.20.2 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Policy Secure (IPS) versions 22.7R1.x ant\u00e9rieures \u00e0 22.7R1.2",
"product": {
"name": "Policy Secure (IPS)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions 10.0.x ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Endpoint Manager versions 2022 SU6 et ant\u00e9rieures sans le dernier correctif publi\u00e9 par l\u0027\u00e9diteur",
"product": {
"name": "Endpoint Manager (EPM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Endpoint Manager versions 2024 et ant\u00e9rieures sans le dernier correctif publi\u00e9 par l\u0027\u00e9diteur",
"product": {
"name": "Endpoint Manager (EPM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Desktop and Server Management (DSM) versions 2024.2 ant\u00e9rieures \u00e0 2024.3.5740",
"product": {
"name": "Desktop and Server Management (DSM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions 10.1.x ant\u00e9rieures \u00e0 10.1.0",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Ivanti Cloud Services Application (CSA) versions 5.0.x ant\u00e9rieures \u00e0 5.0.3",
"product": {
"name": "Cloud Service Appliance (CSA)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Connect Secure (ICS) versions 22.7R2.x ant\u00e9rieures \u00e0 22.7R2.4",
"product": {
"name": "Connect Secure (ICS)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Sentry versions 9.20.x ant\u00e9rieures \u00e0 9.20.2",
"product": {
"name": "Sentry",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-9844",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9844"
},
{
"name": "CVE-2024-37377",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37377"
},
{
"name": "CVE-2024-11772",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11772"
},
{
"name": "CVE-2024-7572",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7572"
},
{
"name": "CVE-2024-8540",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8540"
},
{
"name": "CVE-2024-11773",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11773"
},
{
"name": "CVE-2024-10256",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-10256"
},
{
"name": "CVE-2024-11633",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11633"
},
{
"name": "CVE-2024-11639",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11639"
},
{
"name": "CVE-2024-37401",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37401"
},
{
"name": "CVE-2024-11634",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11634"
}
],
"initial_release_date": "2024-12-11T00:00:00",
"last_revision_date": "2024-12-11T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-1058",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ivanti. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Ivanti",
"vendor_advisories": [
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256"
},
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773"
},
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Sentry-CVE-2024-8540",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2024-8540"
},
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Desktop-and-Server-Management-DSM-CVE-2024-7572",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Desktop-and-Server-Management-DSM-CVE-2024-7572"
},
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs",
"url": "https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs"
}
]
}
CVE-2026-83527 (GCVE-0-2026-83527)
Vulnerability from nvd – Published: 2026-09-08 14:36 – Updated: 2026-09-09 04:26
VLAI
EPSS
VEX
Summary
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 00:00 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:51.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.8.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "R10.7.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "R10.6.4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authentication Bypass vulnerability in Sentry before\u0026nbsp;R10.8.2, R10.7.3 and R10.6.4\u0026nbsp;allows a remote unauthenticated attacker to gain\u0026nbsp;administrative\u0026nbsp;level access.\u0026nbsp;"
}
],
"value": "An Authentication Bypass vulnerability in Sentry before\u00a0R10.8.2, R10.7.3 and R10.6.4\u00a0allows a remote unauthenticated attacker to gain\u00a0administrative\u00a0level access."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:36:49.418Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-83527",
"datePublished": "2026-09-08T14:36:49.418Z",
"dateReserved": "2026-08-31T16:19:06.248Z",
"dateUpdated": "2026-09-09T04:26:51.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10523 (GCVE-0-2026-10523)
Vulnerability from nvd – Published: 2026-06-09 14:16 – Updated: 2026-06-10 03:58
VLAI
EPSS
VEX
Summary
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 00:00 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10523",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T03:58:55.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.5.2"
},
{
"status": "unaffected",
"version": "R10.6.2"
},
{
"status": "unaffected",
"version": "R10.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authentication Bypass vulnerability (CWE-288)\u0026nbsp;in Ivanti\u0026nbsp;Sentry before the\u0026nbsp;R10.5.2, R10.6.2 and R10.7.1\u0026nbsp;versions\u0026nbsp;allows\u0026nbsp;a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access\u0026nbsp;"
}
],
"value": "An Authentication Bypass vulnerability (CWE-288)\u00a0in Ivanti\u00a0Sentry before the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:17:40.240Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-10523",
"datePublished": "2026-06-09T14:16:41.255Z",
"dateReserved": "2026-06-01T08:57:47.470Z",
"dateUpdated": "2026-06-10T03:58:55.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10520 (GCVE-0-2026-10520)
Vulnerability from nvd – Published: 2026-06-09 14:10 – Updated: 2026-06-12 03:55Summary
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hub.ivanti.com/s/article/Security-Advisor… | |
| https://github.com/watchtowrlabs/watchTowr-vs-Iva… | exploit |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10520",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T03:55:15.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.5.2"
},
{
"status": "unaffected",
"version": "R10.6.2"
},
{
"status": "unaffected",
"version": "R10.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability\u0026nbsp;in Ivanti\u0026nbsp;Sentry before\u0026nbsp;the\u0026nbsp;R10.5.2, R10.6.2 and R10.7.1\u0026nbsp;versions\u0026nbsp;allows\u0026nbsp;a remote unauthenticated user to achieve root-level remote code execution\u0026nbsp;"
}
],
"value": "An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to achieve root-level remote code execution"
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:10:21.581Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-10520",
"datePublished": "2026-06-09T14:10:21.581Z",
"dateReserved": "2026-06-01T08:47:35.793Z",
"dateUpdated": "2026-06-12T03:55:15.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-39338 (GCVE-0-2023-39338)
Vulnerability from nvd – Published: 2025-07-12 03:30 – Updated: 2026-02-26 17:50
VLAI
EPSS
VEX
Summary
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-15 03:55 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-15T03:55:09.924890Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:50:42.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"lessThan": "9.20",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-12T03:30:40.285Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2023-39338"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-39338",
"datePublished": "2025-07-12T03:30:40.285Z",
"dateReserved": "2023-07-28T01:00:12.351Z",
"dateUpdated": "2026-02-26T17:50:42.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8540 (GCVE-0-2024-8540)
Vulnerability from nvd – Published: 2024-12-10 18:52 – Updated: 2024-12-14 04:55
VLAI
EPSS
VEX
Summary
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-13 00:00 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-14T04:55:18.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "9.20.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "10.0.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "10.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eInsecure permissions in Ivanti Sentry \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ebefore versions 9.20.2 and 10.0.2 or 10.1.0\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u0026nbsp;allow a local authenticated attacker to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emodify sensitive application components.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0\u00a0allow a local authenticated attacker to modify sensitive application components."
}
],
"impacts": [
{
"capecId": "CAPEC-75",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-75 Manipulating Writeable Configuration Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T18:52:17.010Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2024-8540"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2024-8540",
"datePublished": "2024-12-10T18:52:17.010Z",
"dateReserved": "2024-09-06T18:11:23.892Z",
"dateUpdated": "2024-12-14T04:55:18.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41724 (GCVE-0-2023-41724)
Vulnerability from nvd – Published: 2024-03-31 01:45 – Updated: 2025-03-25 14:36
VLAI
EPSS
VEX
Summary
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 14:31 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sentry",
"vendor": "ivanti",
"versions": [
{
"lessThanOrEqual": "9.19.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41724",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T14:31:04.406728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T14:36:27.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.551Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.19.0",
"status": "affected",
"version": "9.19.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. "
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-03-31T01:45:42.684Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-41724",
"datePublished": "2024-03-31T01:45:42.684Z",
"dateReserved": "2023-08-31T01:00:11.771Z",
"dateUpdated": "2025-03-25T14:36:27.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-83527 (GCVE-0-2026-83527)
Vulnerability from cvelistv5 – Published: 2026-09-08 14:36 – Updated: 2026-09-09 04:26
VLAI
EPSS
VEX
Summary
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 00:00 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:51.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.8.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "R10.7.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "R10.6.4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authentication Bypass vulnerability in Sentry before\u0026nbsp;R10.8.2, R10.7.3 and R10.6.4\u0026nbsp;allows a remote unauthenticated attacker to gain\u0026nbsp;administrative\u0026nbsp;level access.\u0026nbsp;"
}
],
"value": "An Authentication Bypass vulnerability in Sentry before\u00a0R10.8.2, R10.7.3 and R10.6.4\u00a0allows a remote unauthenticated attacker to gain\u00a0administrative\u00a0level access."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:36:49.418Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-83527",
"datePublished": "2026-09-08T14:36:49.418Z",
"dateReserved": "2026-08-31T16:19:06.248Z",
"dateUpdated": "2026-09-09T04:26:51.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10523 (GCVE-0-2026-10523)
Vulnerability from cvelistv5 – Published: 2026-06-09 14:16 – Updated: 2026-06-10 03:58
VLAI
EPSS
VEX
Summary
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 00:00 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10523",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T03:58:55.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.5.2"
},
{
"status": "unaffected",
"version": "R10.6.2"
},
{
"status": "unaffected",
"version": "R10.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authentication Bypass vulnerability (CWE-288)\u0026nbsp;in Ivanti\u0026nbsp;Sentry before the\u0026nbsp;R10.5.2, R10.6.2 and R10.7.1\u0026nbsp;versions\u0026nbsp;allows\u0026nbsp;a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access\u0026nbsp;"
}
],
"value": "An Authentication Bypass vulnerability (CWE-288)\u00a0in Ivanti\u00a0Sentry before the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:17:40.240Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-10523",
"datePublished": "2026-06-09T14:16:41.255Z",
"dateReserved": "2026-06-01T08:57:47.470Z",
"dateUpdated": "2026-06-10T03:58:55.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10520 (GCVE-0-2026-10520)
Vulnerability from cvelistv5 – Published: 2026-06-09 14:10 – Updated: 2026-06-12 03:55Summary
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hub.ivanti.com/s/article/Security-Advisor… | |
| https://github.com/watchtowrlabs/watchTowr-vs-Iva… | exploit |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10520",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T03:55:15.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "R10.5.2"
},
{
"status": "unaffected",
"version": "R10.6.2"
},
{
"status": "unaffected",
"version": "R10.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS Command Injection vulnerability\u0026nbsp;in Ivanti\u0026nbsp;Sentry before\u0026nbsp;the\u0026nbsp;R10.5.2, R10.6.2 and R10.7.1\u0026nbsp;versions\u0026nbsp;allows\u0026nbsp;a remote unauthenticated user to achieve root-level remote code execution\u0026nbsp;"
}
],
"value": "An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to achieve root-level remote code execution"
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:10:21.581Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-10520",
"datePublished": "2026-06-09T14:10:21.581Z",
"dateReserved": "2026-06-01T08:47:35.793Z",
"dateUpdated": "2026-06-12T03:55:15.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-39338 (GCVE-0-2023-39338)
Vulnerability from cvelistv5 – Published: 2025-07-12 03:30 – Updated: 2026-02-26 17:50
VLAI
EPSS
VEX
Summary
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-15 03:55 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-15T03:55:09.924890Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:50:42.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"lessThan": "9.20",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-12T03:30:40.285Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2023-39338"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-39338",
"datePublished": "2025-07-12T03:30:40.285Z",
"dateReserved": "2023-07-28T01:00:12.351Z",
"dateUpdated": "2026-02-26T17:50:42.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8540 (GCVE-0-2024-8540)
Vulnerability from cvelistv5 – Published: 2024-12-10 18:52 – Updated: 2024-12-14 04:55
VLAI
EPSS
VEX
Summary
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-13 00:00 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-14T04:55:18.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "9.20.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "10.0.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "10.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eInsecure permissions in Ivanti Sentry \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ebefore versions 9.20.2 and 10.0.2 or 10.1.0\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u0026nbsp;allow a local authenticated attacker to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emodify sensitive application components.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
}
],
"value": "Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0\u00a0allow a local authenticated attacker to modify sensitive application components."
}
],
"impacts": [
{
"capecId": "CAPEC-75",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-75 Manipulating Writeable Configuration Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T18:52:17.010Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2024-8540"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2024-8540",
"datePublished": "2024-12-10T18:52:17.010Z",
"dateReserved": "2024-09-06T18:11:23.892Z",
"dateUpdated": "2024-12-14T04:55:18.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41724 (GCVE-0-2023-41724)
Vulnerability from cvelistv5 – Published: 2024-03-31 01:45 – Updated: 2025-03-25 14:36
VLAI
EPSS
VEX
Summary
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 14:31 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ivanti:sentry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sentry",
"vendor": "ivanti",
"versions": [
{
"lessThanOrEqual": "9.19.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41724",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T14:31:04.406728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T14:36:27.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.551Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sentry",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.19.0",
"status": "affected",
"version": "9.19.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. "
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-03-31T01:45:42.684Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-41724",
"datePublished": "2024-03-31T01:45:42.684Z",
"dateReserved": "2023-08-31T01:00:11.771Z",
"dateUpdated": "2025-03-25T14:36:27.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}