10.0
Critical
Exploited
CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-78
Description
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sentry | Versions not published |
References
- hub.ivanti.com hub.ivanti.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Sentry
The 6 CVEs of Sentry →
CVE-2026-83527
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated…
8.1
High
CVE-2026-10523
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and…
9.9
Critical
CVE-2023-39338
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not…
6.8
Medium
CVE-2024-8540
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker…
8.8
High