CVE-2026-10520: Ivanti Sentry OS Command Injection RCE (KEV)

Checked: 2026-10-29

CVE-2026-10520 is an OS command injection vulnerability in Ivanti Sentry that lets a remote, unauthenticated attacker achieve root-level remote code execution, with a maximum CVSS score of 10.0; it is most dangerous on unmanaged Sentry appliances with externally reachable endpoints, and is near-certain to be actively exploited per FIRST's EPSS model.

Vulnerability summary

Vulnerability ID	CVE-2026-10520
CVSS score	10
EPSS score	0.99915
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD (Ivanti Secondary score only, not NVD Primary)
Published	2026-06-09T16:16:35.700

Affected components

Component	CPE	Version range
Ivanti Sentry (Standalone Sentry)	cpe:2.3:a:ivanti:standalone_sentry::::::::	before 10.5.2; 10.6.0 through 10.6.1; exactly 10.7.0 (fixed in 10.5.2, 10.6.2 and 10.7.1 respectively)

What this means

CVE-2026-10520 is an OS command injection vulnerability (CWE-78) in Ivanti Sentry. NVD's description states it "allows a remote unauthenticated user to achieve root-level remote code execution" in Ivanti Sentry versions before R10.5.2, R10.6.2 and R10.7.1 (NVD).

NVD's only CVSS metric on record is an Ivanti-submitted (CNA) Secondary score of CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the maximum possible base score, reflecting network reachability, no authentication, no user interaction, and a scope change with complete confidentiality, integrity and availability impact; NVD's vulnStatus is "Analyzed" but no independent NVD Primary metric has been published (NVD).

CISA's KEV entry gives an important exploitability caveat not visible from the CVSS score alone: "This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors." In other words, Sentry deployments that are actively managed through EPMM with mutual TLS, or that restrict HTTPS access via Neurons for MDM, are not reachable by this attack path, while standalone or unmanaged Sentry appliances exposed directly to the internet are at full risk (CISA KEV).

A public technical write-up and detection-artifact generator from watchTowr Labs documents CVE-2026-10520 alongside the related CVE-2026-10523 as an authentication-bypass-to-remote-code-execution chain against Ivanti Sentry, targeting the /mics/api/v2/sentry/mics-config/handleMessage endpoint and demonstrating unauthenticated command execution (observed running uname -a on a target host) — consistent with NVD's description of unauthenticated, root-level code execution (watchTowr Labs — watchTowr-vs-Ivanti-Sentry-RCE).

CISA added CVE-2026-10520 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-11, with a required-action due date of 2026-06-14 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.99915 (99.968th percentile) — among the highest EPSS scores possible, indicating near-certain ongoing or imminent exploitation attempts against internet-facing, unpatched Sentry appliances (FIRST EPSS).

Any standalone or unmanaged Ivanti Sentry appliance reachable from the internet should be patched to 10.5.2, 10.6.2 or 10.7.1 (as applicable to its branch) immediately; appliances already managed through EPMM with mTLS, or with HTTPS access restricted via Neurons for MDM, carry materially lower exposure but should still be patched on the same timeline.

How to fix this class of issueThis advisory's weakness class is Command injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix command injection in embedded firmware.

Evidence

OS command injection in Ivanti Sentry before R10.5.2, R10.6.2 and R10.7.1 allows a remote unauthenticated user to achieve root-level remote code execution. — NVD
CVSS v3.1 score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted by Ivanti as a CNA Secondary score; NVD has not published its own Primary metric. — NVD
Exploitable when the Sentry appliance is unmanaged with externally reachable endpoints; mTLS with EPMM or restricted HTTPS via Neurons for MDM makes the interface inaccessible to external actors. — CISA KEV
A public write-up documents CVE-2026-10520 chained with CVE-2026-10523 as an auth-bypass-to-RCE chain against the /mics/api/v2/sentry/mics-config/handleMessage endpoint, demonstrating unauthenticated command execution. — watchTowr Labs — watchTowr-vs-Ivanti-Sentry-RCE
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-11, due date 2026-06-14, known ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
EPSS score is 0.99915 (99.968th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2019-1068: Microsoft SQL Server RCE (KEV, re-added 2026)CVE-2019-1068: a 2019 Microsoft SQL Server remote code execution flaw CISA added to its KEV catalog in August 2026, seven years after patching, under its 2026 BOD 26-04 risk-based directive. Versions, scoring sourced to NVD and CISA KEV.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.