The NCSC has issued an update regarding a vulnerability in Ivanti Sentry identified as CVE-2026-10523. After an earlier advisory, additional public material has now appeared, including a proof-of-concept (PoC) code sample that explains how the issue can be exploited. Because that kind of information can lower the barrier for attackers, the overall urgency for patching remains high.
Below, we summarise what has changed, what makes this vulnerability particularly serious, and what practical steps organisations can take to reduce exposure.
What changed in the NCSC update?
In the latest note, the NCSC states that there is “development” around the Ivanti Sentry CVE-2026-10523 vulnerability. Specifically, a PoC has been published publicly, alongside the previously shared NCSC guidance and references to the corresponding security advisory.
The NCSC also mentions that the attack path differs from what was originally described. In other words, even if you already reviewed earlier information, this new PoC can change how exploitation might be approached in practice—making it even more important to focus on mitigation rather than trying to predict exact attacker steps.
Why is CVE-2026-10523 so concerning?
Ivanti Sentry is used by organisations to help manage and protect devices. In many environments, it is operated alongside other Ivanti components, such as Ivanti EPMM.
According to the NCSC advisory, CVE-2026-10523 enables a remote attacker to create administrative accounts without logging in. The vendor assigns this vulnerability a CVSS score of 9.9, which reflects both the likely impact and the severity of the potential compromise.
When an attacker can establish administrative access remotely, the consequences can extend far beyond the initial breach. The attacker may be able to:
- gain persistent control over the affected system,
- access sensitive data, potentially leading to data leaks,
- disrupt business processes that depend on device management and security controls,
- abuse elevated privileges to cause additional damage inside the organisation.
At the time of the NCSC update, there is no evidence of active exploitation. However, the NCSC indicates that exploitation is expected—especially once detailed public guidance (like a PoC) is available.
Context: another Ivanti Sentry vulnerability is part of the picture
This update focuses on CVE-2026-10523, but the original NCSC message also discussed a second critical issue in Ivanti Sentry: CVE-2026-10520.
That vulnerability allows a non-authenticated attacker to execute arbitrary code remotely with full administrator rights (root). The vendor assigns a maximum CVSS score of 10, underlining how serious that risk is.
Together, these issues mean that attackers may not only escalate privileges (via CVE-2026-10523), but could also potentially run code with the highest levels of control (via CVE-2026-10520). The NCSC evaluates both as very severe.
How public research increases the likelihood of misuse
The NCSC notes that a detailed blog post has been published describing the vulnerabilities in depth. The existence of such material can increase the risk of misuse, because it gives attackers a clearer understanding of targets and exploitation techniques.
In line with that reasoning, the NCSC increased the severity rating for the vulnerabilities to High/High. That rating reflects both a high likelihood of exploitation and a high likelihood of resulting harm.
With the PoC for Ivanti Sentry CVE-2026-10523 now also published, the practical risk can rise further. PoC code often helps security teams validate exposure quickly, but it can also help adversaries build or adapt real-world attacks faster.
Is there an active campaign?
The NCSC update states that there is no evidence of active exploitation at the moment. Still, the advisory emphasises that exploitation is expected to follow, particularly after public technical details and PoC material appear.
From an operational perspective, this is a key message: even if you haven’t seen indicators yet, the window for preventing compromise can close quickly once attackers have working examples.
Immediate guidance: install the vendor updates
Ivanti has released updates intended to address the reported vulnerabilities. The NCSC advises organisations to install these security updates as soon as possible.
If you are unsure whether your environment includes Ivanti Sentry—or whether you run a vulnerable version—the NCSC recommends contacting your IT service provider. Ask them to:
- confirm whether Ivanti Sentry is deployed in your environment,
- identify whether your version is affected for CVE-2026-10520 and CVE-2026-10523,
- help plan and execute the patching steps without unnecessary delay,
- verify after installation that the mitigations are correctly applied.
The NCSC points readers to the Ivanti website for a table of affected versions. Your IT team can use that information to match your deployment details to the vendor’s guidance.
Practical steps while you patch
While the core fix is to apply the updated versions, many organisations also take short-term measures to reduce risk during patching. The NCSC update doesn’t list specific temporary controls, but you can still use a sensible approach:
- Inventory quickly: confirm which systems and services rely on Ivanti Sentry and whether any integrations (such as Ivanti EPMM) are in place.
- Prioritise exposure: focus on systems reachable from broader networks first, especially if the service is accessible beyond a strictly controlled management segment.
- Coordinate change management: schedule patching in a way that aligns with business requirements, but avoid long delays.
- Validate outcomes: after updates, verify that the relevant components are operating normally and that the patched versions are indeed installed.
These actions help you reduce uncertainty, even before the environment is fully remediated.
What to tell stakeholders
This kind of vulnerability affects more than “IT”. Because Ivanti Sentry supports device management and security workflows, a compromise could impact operational continuity and sensitive data handling.
When communicating internally, emphasise the core points from the NCSC update:
- Ivanti Sentry CVE-2026-10523 enables remote creation of admin accounts without login.
- A public PoC has appeared, which can increase misuse likelihood.
- No active exploitation is known yet, but it is expected.
- The recommended response is to apply Ivanti’s updates immediately.
Clear messaging helps stakeholders understand why timely remediation matters—even if there are no reported incidents yet.
Conclusion
The NCSC update highlights renewed urgency around Ivanti Sentry CVE-2026-10523. The publication of a public PoC, together with earlier detailed research about these vulnerabilities, can accelerate attacker activity. Even without evidence of active exploitation, the expected risk justifies prompt action.
If you use Ivanti Sentry, treat the vendor updates as a priority task. Confirm whether your versions are affected, install the fixes as soon as possible, and validate that your environment is protected.
Source: https://www.ncsc.nl/alerts/ontwikkeling-in-ivanti-sentry-kwetsbaarheid
