This vulnerability in Ivanti Sentry enables an attacker without authentication to bypass normal authentication mechanisms by exploiting an alternate path or channel. This allows the creation of arbitrary administrative accounts, granting full administrative privileges. The issue affects versions before R10.5.2, R10.6.2, and R10.7.1. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no user interaction, resulting in complete compromise of the system's confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation results in an attacker gaining full administrative access to the Ivanti Sentry system without prior authentication. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing complete control over the environment managed by Ivanti Sentry.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Ivanti Sentry management interfaces and monitor for any suspicious account creation activity. Avoid exposing the service to untrusted networks.