The vulnerability is an authentication bypass (CWE‑288) that allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain complete administrative privileges. This flaw enables the attacker to perform any action available to a legitimate administrator, effectively compromising the entire system’s confidentiality, integrity, and availability.

Ivanti Sentry systems running versions prior to R10.5.2, R10.6.2, or R10.7.1 are affected. Users of these releases should verify their current version and upgrade if necessary.

The CVSS score of 9.9 classifies this as a critical vulnerability. The EPSS score is not available, but the lack of listing in the CISA KEV catalog does not diminish the potential threat. The flaw can be exploited remotely by anyone without authentication, making the attack vector straightforward for attackers with internet access to the target system.