VulnSocial
← Back to blog

CVE-2026-10520 – Critical OS Command Injection in Ivanti Sentry

Key takeaways

  • Critical OS command injection (CWE‑78) in Ivanti Sentry enables pre‑authentication remote code execution as root.
  • Active exploitation began within hours of the public PoC and patch release; dozens of internet‑exposed gateways have been back‑doored.
  • CISA KEV inclusion forces U.S. federal agencies to apply the patch by 2026‑06‑14.
  • Deploy the vendor‑supplied fix (R10.5.2, R10.6.2, R10.7.1) immediately and verify the version.
  • Conduct forensic review, block external access to the Sentry service, and monitor for exploitation indicators.

Overview

CVE-2026-10520 is a pre‑authentication OS command injection (CWE‑78) in Ivanti Sentry that grants remote attackers unauthenticated root‑level code execution. The vulnerability was publicly disclosed on 2026‑06‑09, a patch was released the same day, and active exploitation was reported the next day. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 2026‑06‑11, mandating remediation by 2026‑06‑14.

Technical Details

  • Vulnerability type: OS command injection (pre‑auth). An unauthenticated attacker can inject arbitrary commands into a privileged process, leading to full system compromise.
  • CWE: CWE-78.
  • CVSS v3.1: CVSS 10.0 (Critical) – Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
  • Root cause: Improper validation of user‑supplied input in a network‑exposed API endpoint, allowing command strings to be executed with root privileges.
  • Exploit timeline: A public proof‑of‑concept (PoC) appeared on 2026‑06‑10, after which threat‑intel feeds recorded a surge in exploitation activity (17 active exploitation reports on 2026‑06‑11 and 2026‑06‑12). Shadowserver observed multiple back‑doored gateways within days.
  • Public indicators: Exploit scripts and payloads are circulating on open‑source repositories and have been referenced in multiple threat‑intel tweets.

Severity & Impact

MetricValue
CVSSCVSS 10.0 (Critical)
CWECWE-78
ImpactFull system takeover (root), complete confidentiality, integrity, and availability breach

The combination of a network‑accessible service, no authentication, and root execution makes this flaw one of the most severe remote code execution bugs of 2026.

Affected Products

The flaw affects Ivanti Sentry versions prior to the security‑fixed releases R10.5.2, R10.6.2, and R10.7.1. Known vulnerable builds include 10.7.0 and earlier. For a complete list of affected versions and CPE entries, see the VulnSocial CVE page.

Actionable Insights

  • Identify all deployed Ivanti Sentry instances, especially those exposed to the internet.
  • Verify the exact version; any version earlier than R10.5.2, R10.6.2, or R10.7.1 is vulnerable.
  • Apply the patch immediately from the vendor advisory. Use the latest release (R10.7.1 or newer) to ensure the fix is present.
  • Confirm the patch status by checking the product version string or applying a checksum verification.
  • Conduct forensic analysis on any system that was internet‑exposed before patching – look for unknown user accounts, scheduled tasks, or modified binaries that could indicate a back‑door.
  • Block inbound traffic to the Sentry management interface from untrusted networks (e.g., restrict to internal IP ranges or VPN).
  • Enable IDS/IPS signatures for the known exploit patterns (many security vendors have released detection rules; see vendor advisories for guidance).
  • Monitor logs for anomalous command execution, especially any attempts to invoke shell commands via the vulnerable API endpoint.
  • Follow CISA guidance: prioritize patching per BOD 26‑04, document remediation, and report compliance.

Remediation & Mitigation

  1. Inventory – Run a sweep of the network to locate all Ivanti Sentry appliances (e.g., nmap -p 443,8443 <network>).
  2. Version check – Query each instance (/api/version) to confirm it is not R10.5.2/R10.6.2/R10.7.1 or later.
  3. Apply the patch – Download the update from the Ivanti advisory and install it following the vendor’s step‑by‑step guide.
  4. Validate – After patching, re‑run the version check and optionally test the PoC against a patched system to confirm mitigation.
  5. Forensic review – Examine system logs, file integrity, and network traffic for signs of compromise that may have occurred before patching.
  6. Hardening – Restrict access to the Sentry management interface, enforce MFA for admin accounts, and isolate the appliance on a segmented VLAN.
  7. Continuous monitoring – Subscribe to the VulnSocial CVE page for real‑time threat intel and indicator updates.

References

Bottom line: CVE-2026-10520 is a Critical pre‑auth OS command injection in Ivanti Sentry that has been actively exploited in the wild. Immediate patch and thorough post‑compromise investigation are mandatory.

#CVE #Critical #RCE #CISAKEV #Ivanti #Sentry #CVE202610520