CVE-2026-10520

10CRITICAL

Key Information:

Vendor

Ivanti
Status
Sentry
Vendor
CVE Published:
9 June 2026

Badges

📈 Score: 439👾 Exploit Exists📰 News Worthy

What is CVE-2026-10520?

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Affected Version(s)

Sentry R10.5.2

Sentry R10.5.2

Sentry R10.6.2

News Articles

favicon imageThe Hacker News

Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

Fortinet, Ivanti, and SAP patched critical flaws up to CVSS 10.0, reducing RCE, admin takeover, and data exposure risks.

2 hours ago

favicon imagetheregister

Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9

Remote, unauthenticated RCE with root privileges is about as bad as it gets

6 hours ago

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by theregister

  • Vulnerability published

  • Vulnerability Reserved

.