CVE-2026-10520

Published Jun 9, 2026

Last updated 9 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-10520 is an operating system command injection vulnerability affecting Ivanti Sentry, a mobile security gateway. This flaw allows a remote, unauthenticated attacker to achieve root-level remote code execution on affected systems. Specifically, the vulnerability is located within the `ConfigServiceController` class of the Sentry web application. It can be exploited by sending a specially crafted POST request to the unauthenticated endpoint `/mics/api/v2/sentry/mics-config/handleMessage`. This request is then interpreted as an internal MICS configuration command and executed by a backend component.

Description: An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed
Products: standalone_sentry

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Ivanti Sentry OS Command Injection Vulnerability
Exploit added on: Jun 11, 2026
Exploit action due: Jun 14, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C33107C3-2CB4-495C-ACB2-F1440ADAA2B0",
            "versionEndExcluding": "10.5.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F5579D89-84ED-45BA-922F-B84DC5E3EE93",
            "versionEndExcluding": "10.6.2",
            "versionStartIncluding": "10.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:standalone_sentry:10.7.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "7F16798C-197D-4CED-BCD1-9C93A28D29D2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.•CVE-2024-8540

References

Sources include official advisories and independent security research.