10.0
Critique
Exploitée
CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-78
Description
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Sentry | Versions non publiées |
Références
- hub.ivanti.com hub.ivanti.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Sentry
Les 6 CVE de Sentry →
CVE-2026-83527
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated…
8.1
Élevée
CVE-2026-10523
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and…
9.9
Critique
CVE-2023-39338
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not…
6.8
Moyenne
CVE-2024-8540
Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker…
8.8
Élevée