CVE-2026-10520
CWE-78Published: June 9, 2026· Updated: Jun 17, 2026
Official Description
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Risk Analysis
This critical OS Command Injection vulnerability in Ivanti Sentry allows a remote, unauthenticated attacker to achieve root-level remote code execution. With a perfect CVSS score of 10.0, this flaw represents an extreme risk of complete system takeover. It is confirmed to be actively exploited, demanding immediate action.
This vulnerability is actively being exploited in the wild. It is remotely exploitable over the network with low attack complexity and requires no authentication.
Upgrade Ivanti Sentry to versions R10.5.2, R10.6.2, R10.7.1, or later. Implement network segmentation and access controls to limit exposure of Ivanti Sentry devices.
Technical Analysis
CVE-2026-10520 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CISA has added CVE-2026-10520 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
News & Research Mentioning CVE-2026-10520
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, updating BOD 22-01. BOD 26-04 reinforces the importance of the KEV catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposur [xlite_meta score:48 src:CISA Alerts xlite_fp:a51d0ef1fe4245ef759fcb911ca3f19ea532244ec8e87c5564c9650446f7eccc]
All References (3)
Quick Facts
Related CVEs (CWE-78)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-10520 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1