The vulnerability is an authentication bypass (CWE-288) that permits a remote attacker to create arbitrary administrative accounts on the Ivanti Sentry platform, granting full administrative control over the system.

Ivanti Sentry installations running any release before R10.5.2, R10.6.2 or R10.7.1 are affected; administrators should verify which version they are operating and consider upgrading.

The CVSS score of 9.9 marks this flaw as critical, and the EPSS score of 47% indicates a relatively high probability of exploitation. The remote unauthenticated attack vector allows any internet-exposed system to be targeted, and it is inferred from the description that creating administrative accounts directly grants full administrative access, with no further state or privilege escalation steps required.