CVE-2026-10520: Ivanti Sentry OS command injection allows unauthenticated root RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable root RCE with a CVSS score of 10, KEV listing and near-certain EPSS probability makes this an immediate patch-or-isolate case.

What it is

Ivanti Sentry before R10.5.2, R10.6.2 and R10.7.1 contains an OS command injection flaw (CWE-78) that lets a remote unauthenticated user execute commands at root level. It is remotely reachable over the network with no privileges or user interaction, and it is listed in CISA KEV, making it a top remediation priority.

Impact

An attacker gains root-level remote code execution on the Sentry appliance, allowing full control of the device, its configuration and any data or credentials it handles. Because no authentication is required, any internet-exposed instance is directly at risk.

Attack surface

Reached over the network via the vulnerable Sentry interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is needed, so any reachable instance is exposed.

Exploitation

CVE-2026-10520 is in CISA KEV (added 2026-06-11) and has an EPSS 30-day probability of 0.99915 (99.968th percentile), indicating active exploitation is expected or observed. A public third-party proof-of-concept reference exists, and no ransomware use is documented.

What to do

• Upgrade Ivanti Sentry to R10.5.2, R10.6.2 or R10.7.1 or later per the vendor advisory.
• If patching is not immediately possible, apply the vendor's mitigations or take the appliance off the internet until it is fixed.
• Restrict network access to Sentry management and service interfaces to trusted sources only.
• Follow CISA BOD 26-04 guidance, including the KEV due date of 2026-06-14, and discontinue use if mitigations are unavailable.
• Rotate credentials and secrets stored or processed by Sentry after remediation, since root compromise may have exposed them.

Detection

• Review Sentry and host logs for unexpected command execution, shell child processes, or anomalous outbound connections from the appliance.
• Hunt for exploitation attempts against Sentry interfaces in web, proxy and IDS/IPS logs, using the public PoC reference for request patterns.
• Monitor for new or modified files, cron jobs, and unauthorized accounts on Sentry hosts that would indicate post-exploitation persistence.
• Alert on Sentry appliances still running versions below R10.5.2, R10.6.2 or R10.7.1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.