Exploitation observed; activity peaked at 18 mentions and remains active
Immediate actions
Patch ivanti standalone_sentry systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Active Exploitation1Disclosure3Exploit3General2Patch7PoC2
2026-06-11
9
Active Exploitation4Disclosure2Exploit1Patch1PoC1
2026-06-12
5
Active Exploitation2Disclosure2Patch1
2026-06-13
3
Exploit1General1Patch1
2026-06-14
2
Patch2
2026-06-15
2
General1Patch1
2026-06-17
2
General1Patch1
2026-06-18
1
Patch1
2026-06-23
1
Exploit1
2026-07-05
1
General1
2026-07-11
4
General4
2026-07-12
1
Patch1
2026-07-14
1
Patch1
2026-07-15
4
PoC4
2026-07-22
1
General1
2026-08-08
1
Active Exploitation1
2026-08-21
1
Patch1
2026-09-08
1
General1
>Full discourse20 posts
Rishi@rxerium·
Active Exploitation
🚨 CVE-2026-10520, a critical (CVSS 10.0) OS Command Injection vulnerability in Ivanti Sentry is now under active exploitation as reported by @DefusedCyber
Scan infrastructure to see if you're vulnerable:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-10520.yaml
Patches are available as per Ivanti's advisory:
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
Post summary
The post confirms that CVE‑2026‑10520, a critical OS Command Injection vulnerability in Ivanti Sentry, is actively exploited, while also providing patch information and a PoC link.
🚨 BREAKING: Ivanti Sentry CVE-2026-10520 (CVSS 10.0) is under active exploitation, one day after a public PoC dropped. Shadowserver counts many exposed vulnerable instances, they're being backdoored. Assume compromise.
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US https://t.co/b8cPNENZ1D
Post summary
Ivanti Sentry CVE-2026‑10520 with a CVSS score of 10.0 is currently being actively exploited in the wild, as reported by Shadowserver, with many vulnerable instances being backdoored. No patch or mitigation details are provided.
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-10523
PT ID: PT-2026-47807
Vendor: ivanti
Product: Sentry
Description: An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
Link: https://github.com/gagaltotal/CVE-2026-10523-Ivanti-sentry
#dbugs_vuln
Post summary
An authentication bypass vulnerability (CVE‑2026‑10523) in Ivanti Sentry has a publicly disclosed PoC/exploit on GitHub that enables attackers to create administrative accounts and gain full admin access.
@DefusedCyber Also a script for CVE-2026-10523 - an Authentication Bypass vulnerability affecting Ivanti Sentry can be found below:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-10523.yaml
Post summary
A GitHub script demonstrates an authentication bypass for CVE-2026-10523 in Ivanti Sentry, providing a functional exploit. No active exploitation or patch information is mentioned.
Daniel's Daily Threat Intel & CVE Briefing — Fri 7 Aug 2026
Top of the stack: Today is CISA's federal remediation due date for the N-able N-central / Langflow / Tomcat KEV batch — and the N-central bug is the one that matters: CVE-2026-18577, an auth-bypass that is a bypass of the incomplete fix for CVE-2026-18556, is being exploited in the wild since Aug 1 to seize admin on RMM servers and pivot into managed endpoints. If you or clients run N-central, patch to 2026.3.1 Hotfix 1 (2026.3.1.7) and hunt for post-compromise activity before anything else today.
1. CISA KEV / actively exploited (lead)
CVE-2026-18577 — N-able N-central, all versions ≤ 2026.3.1 (pre-Hotfix 1). Unauth auth-bypass → full admin. Exploited in the wild from Aug 1; added to KEV Aug 3. Post-exploit TTPs: abuse of the Take Control feature to reach managed endpoints + Cloudflare Tunnel for persistent backdoor. Fix: 2026.3.1.7. So what: RMM = one box to own the whole estate; treat any unpatched N-central as presumed-compromised.
CVE-2026-18556 — N-able N-central auth-bypass (the incompletely-patched precursor to 18577), CVSS 8.2. KEV, federal due date today.
CVE-2026-9198 — Langflow (open-source AI app-dev platform), CVSS 9.8, unauth code-injection → RCE. Fixed 1.10.1. Repeatedly weaponized in recent months; KEV, due today. So what: internet-exposed AI/LLM tooling is now a routine initial-access target.
CVE-2026-34486 — Apache Tomcat, CVSS 7.5, EncryptInterceptor cluster-messaging bypass. Fixed 11.0.21 / 10.1.54 / 9.0.117. Tied to SNOWLIGHT malware campaign; KEV, due today.
CVE-2026-63077 — JetBrains TeamCity deserialization flaw, added to KEV this week. Verify your CI/CD estate isn't exposing TeamCity to untrusted networks.
2. Edge / network gear
CVE-2026-20316 — Cisco Secure Firewall Management Center (FMC) 7.0–7.7 / 10.0. Static credentials for a low-priv account → unauth remote access to sensitive data; actively exploited as a zero-day (disclosed Jul 30). Base CVSS only 5.3 but Cisco rates SIR High because it's chainable for privilege escalation. So what: not the headline score, but it's live and it's your firewall manager — patch and rotate.
Fortinet/Ivanti criticals (FortiSandbox CVE-2026-25089 9.8; Ivanti Sentry CVE-2026-10520 10.0 / CVE-2026-10523 9.9) are from the June 10 cycle — no new exploitation reported in the last 24–48h; flagged only in case anything remains unpatched.
3. Microsoft / Windows / AD
Quiet in the last 24h. No new in-the-wild Windows/AD/Exchange/Entra items surfaced. August Patch Tuesday lands Aug 11 — July's record 622-flaw cycle (2 zero-days under active attack) should already be deployed; if not, that's your gap.
4. Web / cloud / DevOps
CVE-2026-66066 — Rails Active Storage (< 7.2.3.2, 8.0.x < 8.0.5.1, 8.1.x < 8.1.3.1; 6.x only if configured off-default). Critical; unauth arbitrary file read → potential RCE via libvips ("KindaRails2Shell", pivots on the app master key). Public PoC available (disclosed Aug 1). Mitigation: upgrade Rails/Active Storage, libvips ≥ 8.13, ruby-vips ≥ 2.2.1.
CVE-2026-63030 + CVE-2026-60137 — WordPress core "wp2shell" chain (REST batch-route confusion + author__not_in SQLi). Unauth RCE on default installs 6.9.0–6.9.4 / 7.0.0–7.0.1. Public exploits on GitHub; watchTowr reports in-the-wild exploitation. Fixed 6.9.5 / 7.0.2 (forced auto-update pushed). Slightly older (Jul 18) but still actively exploited — worth a scan sweep.
Watch / developing
Oracle out-of-band Security Alert CVE-2026-35273 surfaced this week — details thin, worth confirming scope. Senserva notes ~30 KEV entries this month with 2 tied to ransomware campaigns (Microsoft/Fortinet/Cisco most-affected) — watch for ransomware operators folding the N-central and Langflow bugs into their access-broker playbooks.
Sign-off: 7 items flagged actively exploited today (N-central ×2, Langflow, Tomcat, TeamCity, Cisco FMC, WordPress wp2shell); the single must-do is patching N-central before CISA's due date closes.
Sources:
CISA — Adds Three KEVs (Aug 4)
CISA — Adds One KEV (Aug 3)
The Hacker News — CISA flags Langflow, Tomcat, N-central
Rapid7 — CVE-2026-18577 N-central exploited in the wild
N-able — N-central Security Update (Aug 2)
The Hacker News — Cisco FMC zero-day actively exploited
BleepingComputer — Rails Active Storage RCE (CVE-2026-66066)
BleepingComputer — WordPress wp2shell RCE public exploits
SecurityWeek — Fortinet/Ivanti critical patches
Senserva — CISA KEV additions this week
One caveat worth noting for your own verification: NVD detail pages were unreachable during this run, so severities above are corroborated against vendor advisories, CISA, and reputable trackers rather than NVD directly — the Langflow 9.8 and Cisco 5.3 figures each have two independent sources, but confirm against NVD before citing formally.
Post summary
The briefing highlights several CVEs—especially N‑central, Langflow, Tomcat, TeamCity, Cisco FMC, and WordPress wp2shell—actively exploited in the wild, with public PoCs and vendor patches supplied, urging rapid remediation.
🚨 On 6/9/26, #Ivanti published a security advisory for 2 critical vulns affecting Ivanti Sentry (FKA MobileIron Sentry).
CVE-2026-10520 (CVSS 10.0) is an OS command injection vuln, and CVE-2026-10523 (CVSS 9.9) is an authentication bypass vuln.
Read on: https://r-7.co/4arpQHd https://t.co/F4mG85Vk5u
Post summary
Ivanti announced two critical vulnerabilities in Ivanti Sentry—CVE‑2026‑10520 (OS command injection, CVSS 10.0) and CVE‑2026‑10523 (authentication bypass, CVSS 9.9).
🔼 Analysis of the vulnerability chain CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry
PT ID: PT-2026-47806
The research describes two critical vulnerabilities in Ivanti Sentry: CVE-2026-10520 and CVE-2026-10523 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-10523). The first is an OS command injection vulnerability (CWE-78): improper input handling in an API allows arbitrary commands to be executed at the operating system level without authentication. The second is an authentication bypass vulnerability (CWE-288), which allows a remote attacker to bypass authentication mechanisms and create arbitrary administrative accounts with full system access.
The combination of these vulnerabilities enables a full pre-auth compromise chain: an attacker can first bypass authentication to gain administrative access, and then leverage command injection to execute code with root privileges. This can lead to complete control over the gateway, compromise of credentials and session tokens, and also opens the path for further lateral movement within the infrastructure.
📎 Article: https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
#dbugs_attacks
Post summary
The text outlines two critical Ivanti Sentry vulnerabilities, detailing their types, exploitation chain, and impact, but provides no PoC, exploit code, or evidence of active attacks.
This post confirms that CVE‑2026‑10520 is an OS command injection vulnerability in Ivanti Sentry, with publicly available PoC and exploit code, real‑world exploitation has been observed, and vendor patches are available. The information provides a comprehensive view of the risk and mitigation steps.
CVE-2026-10520 (Pre-auth OS Command Injection in Ivanti Sentry) is now under active exploitation!
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
Post summary
The text announces that CVE‑2026‑10520, a pre‑authentication OS command injection vulnerability in Ivanti Sentry, is currently being exploited in the wild.
This GitHub repo appears to host code for RCE vulnerabilities CVE‑2026‑10520 and CVE‑2026‑10523, likely containing exploit scripts, but it does not mention active exploitation, patches, or detailed technical info.
The tweet announces a critical root-level remote code execution flaw (CVE-2026-10520) in Ivanti Sentry, without mentioning a PoC, exploit code, active exploitation, or patch information.
🚨 CVE-2026-10523 ALERT 🚨
A critical Ivanti Sentry authentication bypass (CVSS 9.9) could let attackers gain admin access without authentication.
Update immediately (10.5.2/10.6.2/10.7.1).
Patch now, stay secure with ROOTNIK LABS.
#CyberSecurity#CVE#VAPT#rootniklabs https://t.co/y3O6y2RDXj
Post summary
The post announces a critical authentication bypass (CVE-2026-10523) for Ivanti Sentry and urges users to apply the listed patch versions immediately. It highlights the severity (CVSS 9.9) and the need for prompt remediation.
ぱっちちゅーずでー
▼Microsoft
2026 年 6 月のセキュリティ更新プログラム (月例)
https://www.microsoft.com/en-us/msrc/blog/2026/06/202606-security-update
▼SAP
SAP Security Patch Day - June 2026
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html
▼Ivanti
Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-6973 & CVE-2026-10727)
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US
▼Fortinet
PSIRT Advisories | FortiGuard Labs
https://fortiguard.fortinet.com/psirt
Second-Order OS Command Injection via JSON Input on start vnc feature（CVE-2026-25089）
https://fortiguard.fortinet.com/psirt/FG-IR-26-141
▼Adobe
https://helpx.adobe.com/security.html
Post summary
The post catalogs a series of security advisory links from Microsoft, SAP, Ivanti, Fortinet, and Adobe, noting several CVE identifiers and providing a brief technical description for a Fortinet vulnerability, but it contains no mention of PoCs, active exploitation, or patches.
Not my tool. My exploit kit for this vuln is still priv8.
Someone coded an exploit for it but mine is better 😉
# Ivanti Sentry Multi-Exploit Kit (CVE-2026-10520 + CVE-2026-10523)
## Description
Advanced military-grade exploit kit chaining Authentication Bypass (CVE-2026-10523) + OS Command Injection (CVE-2026-10520) for unauthenticated root RCE on Ivanti Sentry.
Full reverse shell, config dump, persistence supported.
Post summary
The note promotes a military‑grade exploit kit that chains two Ivanti Sentry CVEs, offering root RCE, reverse shell, and persistence, but it does not confirm active use or provide patches.
Ivanti Sentry max-severity RCE
Ivanti Sentry max-severity flaw is being exploited. CVE-2026-10520, CVSS 10 unauthenticated OS command injection -> root RCE.
Public PoC is out; Shadowserver says many exposed gateways are already backdoored. Patch to R10.5.2 / R10.6.2 / R10.7.1 now (also fixes auth-bypass CVE-2026-10523).
Source: @BleepinComputer@VulnerabilityNw
Post summary
CVE-2026-10520 is a critical unauthenticated OS command injection that is actively exploited, with public PoC released and many gateways compromised; patches are now available for affected Ivanti Sentry versions.
Directoratul Național de Securitate Cibernetică@DNSC_RO·
General
🚨 ALERTĂ - Vulnerabilități critice la nivelul Ivanti Sentry
⚠️ Ivanti a publicat informații cu privire la două vulnerabilități critice identificate în produsul Ivanti Sentry: CVE-2026-10520 și CVE-2026-10523.
👉 https://www.dnsc.ro/citeste/alerta-vulnerabilitati-critice-la-nivelul-ivanti-sentry
#DNSC#Alert#CyberSecurity#CVE https://t.co/LK5PR6YLEX
Post summary
The tweet announces that Ivanti has released information on two critical vulnerabilities (CVE‑2026‑10520 and CVE‑2026‑10523) affecting Ivanti Sentry, but provides no further technical details, exploits, or mitigation information.
CVE-2026-10520 (CVSS 10.0) enables unauthenticated RCE as root on Ivanti Sentry via command injection. CVE-2026-10523 (CVSS 9.9) bypasses authentication to create admin accounts. Public PoC available — patch immediately to versions 10.7.1, 10.6.
#DFIR_Radar https://t.co/5i5ze1n6gt
Post summary
High‑severity CVEs in Ivanti Sentry now have publicly available proofs of concept; immediate patching to versions 10.7.1 or 10.6 is recommended.
Ivanti Sentry pre-auth OS command injection (CVE-2026-10520) achieves perfect 10.0 CVSS with unauthenticated root RCE. Watchtowr Labs demonstrates exploitation using hardcoded XML format leaked in patch analysis.
Technical breakdown:
• CVE-2026-10520 affects Sentry versions before R10.5.2/R10.6.2/R10.7.1 via `/mics/api/v2/sentry/mics-config/handleMessage` endpoint
• Vulnerable code parses user input as MICS configuration commands, routing "execute" commands to `executeNativeCommand()`
• Exploitation requires XML payload: `execute system /configuration/system/commandexec <commandexec><index>1</index><reqandres>[COMMAND]</reqandres></commandexec>`
• Also includes CVE-2026-10523 auth bypass allowing arbitrary admin account creation
• Patch removes user input control AND adds Apache regex blocking unauthenticated access
• Attack targets mobile device gateway sitting between corporate fleets and Exchange/internal systems
• Successful exploitation provides direct path to internal infrastructure from network edge position
Hunt for POST requests to `/mics/api/v2/sentry/mics-config/handleMessage` with XML payloads containing `<commandexec>` tags or system commands in request bodies.
#DFIR_Radar
Post summary
Watchtowr Labs released a proof‑of‑concept for CVE-2026‑10520, a pre‑authentication OS command injection in Ivanti Sentry, detailing a specific XML payload for exploitation; the vendor has issued a patch, and there is no evidence of active exploitation.
Full Tweet
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-10523
PT ID: PT-2026-47807
0day Intel: 🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-10523
PT ID: PT-
Post summary
The tweet announces a discovered PoC/exploit for CVE-2026-10523, but provides no technical details or patch information.
