Path traversal in Ivanti Standalone Sentry - CVE-2026-123181
Published: November 10, 2026
Vulnerability identifier: #VU164602
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123181
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to create arbitrary directories and files with root privileges.
The vulnerability exists due to improper restriction of file paths in Ivanti Sentry when processing user-supplied paths. A remote privileged user can supply crafted paths that traverse outside the intended directory to create arbitrary directories and files with root privileges.
Affected software
Ivanti Standalone Sentry
How to mitigate CVE-2026-123181
Install security update from vendor's website.
Ivanti Standalone Sentry - addressed in versions 10.7.4, 10.8.3, 11.0.0