CVE WatchSep 8, 2026

CVE-2026-83527

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain admini

CVSS

8.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-288

EPSS · 30d

Not enough EPSS history yet.

Technical description

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

Official references

forums.ivanti.comhttps://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-77103—

—

———CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.8h CVE-2026-626508.8 HIG

—

——0A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.3h CVE-2026-761697.5 HIG

42.8%

——13fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.3h CVE-2026-629169.1 CRI

45.7%

——14Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.5h CVE-2026-847777.4 HIG

14.9%

——4Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.5d CVE-2026-811683.7 LOW

26.4%

——8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.6d