Cyber Resilience

CVE-2026-10520

CriticalCISA KEVActive ExploitationRCEUpdated

Published: 09 June 2026

Published
09 June 2026
Modified
17 June 2026
KEV Added
11 June 2026
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.9894 99.9th percentile
Risk Priority 100 floored blend · peak EPSS

Summary

CVE-2026-10520 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ivanti Standalone Sentry. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

An OS Command Injection vulnerability tracked as CVE-2026-10520 affects Ivanti Sentry prior to versions R10.5.2, R10.6.2, and R10.7.1. The flaw, assigned CWE-78, carries a CVSS 3.1 score of 10.0 and permits unauthenticated remote attackers to inject and execute operating system commands.

A remote unauthenticated attacker can exploit the issue over the network without credentials or user interaction to obtain root-level remote code execution on the affected appliance, giving full control of the system and any data it processes.

Ivanti has published a security advisory detailing the affected releases and the fixed versions. The vulnerability also appears in CISA’s Known Exploited Vulnerabilities catalog, confirming that mitigations and patches should be applied promptly.

A public proof-of-concept and technical analysis are available from watchTowr Labs, and the EPSS score has reached 0.5952, indicating substantial exploitation interest.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CWE(s)
CWE-78
KEV Date Added
11 June 2026

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in public-facing Ivanti Sentry appliance enables unauthenticated remote exploitation (T1190) resulting in direct OS command execution (T1059.004 Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

ivanti
standalone sentry
10.7.0 · ≤ 10.5.2 · 10.6.0 — 10.6.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely application of vendor patches to eliminate the command-injection flaw in Ivanti Sentry versions prior to R10.5.2/R10.6.2/R10.7.1.

SI-10 Information Input Validation good match
prevent

Mandates validation and sanitization of all input to block the OS command injection (CWE-78) that enables unauthenticated RCE.

SC-7 Boundary Protection partial match
prevent

Enforces boundary protection and network-access restrictions that limit exposure of the vulnerable Ivanti Sentry appliance to remote unauthenticated attackers.

References