{"id":"CVE-2026-123181","kind":"vulnerability","aliases":["CVE-2026-123181"],"related":[],"title":"Ivanti Sentry: path traversal lets admins write root-owned files","description":"A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.","summary":"Ivanti Sentry before 10.7.4 and 10.8.3 has a path traversal flaw that lets an authenticated administrator create arbitrary directories and files as root. An attacker holding admin credentials can write files anywhere on the appliance with root privileges.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ivanti-sentry","self-hosted","vendor","vpn-gateway"],"not_affected_if":["admin-access-restricted","patched-version"],"how_to_check":"- Check the installed Ivanti Sentry version in the admin console and compare it with `10.7.4` and `10.8.3`.","fix":"- Ivanti Sentry 10.7.x: move to `10.7.4` or later.\n- Ivanti Sentry 10.8.x: move to `10.8.3` or later.","status":"open","published_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:36+00:00","updated_at":"2026-11-10T16:23:36+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T16:23:36Z","model":"claude-haiku-5-5","output":{"fix":"- Ivanti Sentry 10.7.x: move to `10.7.4` or later.\n- Ivanti Sentry 10.8.x: move to `10.8.3` or later.","reach":"network","title":"Ivanti Sentry: path traversal lets admins write root-owned files","impact":"high","summary":"Ivanti Sentry before 10.7.4 and 10.8.3 has a path traversal flaw that lets an authenticated administrator create arbitrary directories and files as root. An attacker holding admin credentials can write files anywhere on the appliance with root privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti-sentry","vpn-gateway","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker writes arbitrary root-owned files on the Sentry server","analyst_note":"","how_to_check":"- Check the installed Ivanti Sentry version in the admin console and compare it with `10.7.4` and `10.8.3`.\n- unknown for any other check, the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","admin-access-restricted"],"who_is_affected":"Organisations running Ivanti Sentry versions before 10.7.4 or 10.8.3. Exploitation requires a remote attacker who already has administrative privileges on Sentry, so the risk is mainly to deployments where admin access is broadly held or poorly protected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000735,"input_tokens":4538,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123181':14A,17A '-2026':13A,16A '10.7.4':31B,75C '10.8.3':33B,77C 'admin':6A,54B 'administr':43B,84C 'allow':78C 'anywher':59B 'applianc':62B 'arbitrari':45B,88C 'attack':52B,82C 'authent':42B,81C 'creat':44B,87C 'credenti':55B 'cve':12A,15A 'directori':46B,89C 'file':11A,48B,58B,91C 'flaw':38B 'gateway':27B 'hold':53B 'host':23B 'ivanti':1A,19B,28B,71C 'ivanti-sentri':18B 'let':5A,40B 'own':10A 'path':3A,36B,67C 'privileg':65B,85C,94C 'remot':80C 'root':9A,50B,64B,93C 'root-own':8A 'self':22B 'self-host':21B 'sentri':2A,20B,29B,72C 'travers':4A,37B,68C 'vendor':24B 'version':74C 'vpn':26B 'vpn-gateway':25B 'vulner':69C 'write':7A,57B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Ivanti Sentry versions before 10.7.4 or 10.8.3. Exploitation requires a remote attacker who already has administrative privileges on Sentry, so the risk is mainly to deployments where admin access is broadly held or poorly protected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ivantisentry","medium","selfhosted","vendor","vpngateway"],"campaign_type":null,"search_a":"'-123181':14A,17A '-2026':13A,16A 'admin':6A 'cve':12A,15A 'file':11A 'ivanti':1A 'let':5A 'own':10A 'path':3A 'root':9A 'root-own':8A 'sentri':2A 'travers':4A 'write':7A","search_b":"'10.7.4':31B '10.8.3':33B 'admin':54B 'administr':43B 'anywher':59B 'applianc':62B 'arbitrari':45B 'attack':52B 'authent':42B 'creat':44B 'credenti':55B 'directori':46B 'file':48B,58B 'flaw':38B 'gateway':27B 'hold':53B 'host':23B 'ivanti':19B,28B 'ivanti-sentri':18B 'let':40B 'path':36B 'privileg':65B 'root':50B,64B 'self':22B 'self-host':21B 'sentri':20B,29B 'travers':37B 'vendor':24B 'vpn':26B 'vpn-gateway':25B 'write':57B","search_c":"'10.7.4':75C '10.8.3':77C 'administr':84C 'allow':78C 'arbitrari':88C 'attack':82C 'authent':81C 'creat':87C 'directori':89C 'file':91C 'ivanti':71C 'path':67C 'privileg':85C,94C 'remot':80C 'root':93C 'sentri':72C 'travers':68C 'version':74C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123181","severity":null,"published_at":"2026-11-10T16:17:18+00:00","modified_at":"2026-11-10T16:17:18+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}