CVE-2026-10520
Ivanti Sentry software has a critical OS command injection flaw that lets anyone on the internet run commands as root. The vulnerability exists in versions before R10.5.2, R10.6.2, and R10.7.1. An attacker could take full control of the affected system.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Ivanti Sentry standalone versions, specifically those before R10.5.2, R10.6.2, and R10.7.1, including ivanti standalone_sentry and ivanti standalone_sentry 10.7.0.
Real-world impact
An attacker could execute arbitrary commands with root privileges, effectively taking over the entire system.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable over the network, requires no user interaction, and gives an attacker full control over the system.
What to do about it
- 01Upgrade Ivanti Sentry to version R10.5.2 or later (or R10.6.2/R10.7.1).
NVD-referenced vendor advisory
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jun 11, 2026 · Jun 11, 2026Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jun 14, 2026 · Jun 14, 2026CISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 23, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 7d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- hub.ivanti.com/s/article/Security-Advisory…patchvendor advisory
- github.com/watchtowrlabs/watchTowr-vs-…third party advisory
- cisa.gov/known-exploited-vulnerabili…us government resource