Vulnerability hidden in Ivanti Sentry

Ivanti identified a vulnerability in Sentry versions prior to R10.8.2, R10.7.3, and R10.6.4. This vulnerability involves an authentication bypass, allowing external attackers without authentication access to gain administrative privileges. This vulnerability affects multiple releases of the Sentr...

CVE-2026-83527

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

CVE-2026-83527

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

EUVD-2026-72812

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

CVE-2026-83527

CVE-2026-83527 is an Authentication Bypass vulnerability in Ivanti Sentry affecting versions before R10.8.2 , R10.7.3 , and R10.6.4 . A remote unauthenticated attacker can exploit it to gain administrative-level access , resulting in high impact to confidentiality, integrity, and availability (CV...

CVE-2026-83527

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

Security Advisory Ivanti Sentry (CVE-2026-83527)

Summary Ivanti has released updates for Ivanti Sentry that address one high severity vulnerability. This vulnerability impacts deployments managed by EPMM and Ivanti Neurons for MDM. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability...

CVE-2026-83527: Authentication Bypass Using an Alternate Path or Channel

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

PT-2026-87102

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access...

github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: opentelemetry-collector-contrib: OpenTelemetry Sentry Exporter: Path traversal allows unauthorized access to Sentry API endpoints

A flaw was found in the OpenTelemetry Sentry exporter. A remote attacker can exploit a path traversal vulnerability by manipulating the service.name attribute. This allows the attacker to craft malicious Sentry API URLs, potentially gaining unauthorized access to sensitive administrative or...

MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database RDB version 2.0.0.1 and earlier contain...

EUVD-2026-66829

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421 ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421 ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421

CVE-2026-81421 affects ddfourtwo sentry-selfhosted-mcp 0.4.0 , where the raw_sentry_api component is vulnerable to server-side request forgery (SSRF) through manipulation of the endpoint argument. The vulnerability allows remote, unauthenticated attacks with low complexity. A Proof-of-Concept exp...

PT-2026-82360

Name of the Vulnerable Software and Affected Versions ddfourtwo sentry-selfhosted-mcp version 0.4.0 Description A flaw in the raw sentry api component allows for server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This ...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Ivanti Standalone_Sentry

CVE-2026-10520 and CVE-2026-10523 An Ivanti Sentry Authentica...

MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...