CVE-2026-10520: Critical Ivanti Sentry Remote Code Execution Vulnerability

Technical summary

CVE-2026-10520 is an OS command injection vulnerability (CWE-78) in Ivanti Sentry that permits remote code execution at the root privilege level. The vulnerability exists in versions prior to R10.5.2, R10.6.2, and R10.7.1. The attack requires no authentication, has low attack complexity, and can be triggered remotely over the network without user interaction, resulting in a CVSS v3.1 score of 10.0 (CRITICAL). The attack impacts confidentiality, integrity, and availability across the entire system scope.

Business impact

Exploitation grants attackers root-level access to Ivanti Sentry deployments, enabling complete system compromise. This can lead to data exfiltration, system destruction, lateral movement to connected infrastructure, and operational disruption. Organizations relying on Sentry for access control or security management face total loss of control over those functions during active exploitation. The KEV designation confirms this is being actively exploited, elevating urgency beyond theoretical risk.

Affected systems

Ivanti Standalone Sentry installations running versions before R10.5.2 (for R10.5.x branch), R10.6.2 (for R10.6.x branch), and R10.7.1 (for R10.7.x branch) are vulnerable. Organizations should verify their installed version against these thresholds immediately. All versions prior to these patches within their respective release lines require patching.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and has minimal attack complexity. Network accessibility is straightforward for any attacker with baseline connectivity to the target. The KEV designation confirms active exploitation in real-world attacks as of June 11, 2026, with an initial remediation deadline of June 14, 2026, indicating rapid weaponization.

Remediation

Upgrade Ivanti Sentry to R10.5.2 or later (if on R10.5.x branch), R10.6.2 or later (if on R10.6.x branch), or R10.7.1 or later (if on R10.7.x branch). Organizations should prioritize patching within 24–48 hours given the CRITICAL severity and active exploitation status. Verify patch deployment against Ivanti's official advisory to confirm the exact version numbers for your release track.

Patch guidance

Consult Ivanti's official security advisory for R10.5.2, R10.6.2, and R10.7.1 patch releases. Download patches only from Ivanti's trusted distribution channels. Before deployment in production, test patches in a staging environment to confirm compatibility with your configuration. Given the CRITICAL nature and KEV status, expedited patching is justified even in change-controlled environments; coordinate with operations and security teams to deploy out-of-cycle if necessary. Document patch application dates and versions for compliance audit trails.

Detection guidance

Monitor network traffic for unusual connections to Ivanti Sentry ports and endpoints. Look for signs of command injection in logs—unusual shell commands, unexpected process spawning, or suspicious script execution originating from the Sentry service or its network interface. Search for evidence of post-exploitation activity: lateral movement attempts, new user accounts, privilege escalation, or data access outside normal baselines. Implement or review EDR/XDR coverage on systems hosting Sentry to detect runtime anomalies. If unpatched systems exist, isolate them from production networks pending patching.

Why prioritize this

CRITICAL severity combined with public KEV listing and active exploitation makes this the highest priority. The combination of zero authentication requirements, remote network accessibility, and root-level impact means every unpatched instance is an immediate, exploitable attack vector. The narrow remediation window (14 days from KEV publication) imposed by CISA underscores operational urgency.

Risk score, explained

The CVSS 3.1 score of 10.0 reflects maximum severity: network-accessible, unauthenticated, low-complexity exploitation leading to complete system compromise (confidentiality, integrity, and availability all HIGH, system scope CHANGED). The KEV status elevates practical risk beyond the numerical score—active exploitation confirms adversaries are weaponizing this flaw in real attacks, not just in labs.

Frequently asked questions