Loading story…
A critical OS command injection vulnerability in Ivanti Sentry, CVE-2026-10520, enables unauthenticated attackers to execute code with root privileges. Rated CVSS 10.0, the flaw involves insufficient input sanitization at the /mics/api/v2/sentry/mics-config/handleMessage endpoint and can be exploited through specially crafted HTTP POST requests. watchTowr published an analysis of the pre-authentication vulnerability, while CrowdSec reported observing exploitation attempts on June 10, 2026, one day after the vulnerability’s publication.
CrowdSec reported that exploitation activity subsequently declined, with some movement from mass scanning toward selective targeting; the observations establish attack attempts, not confirmed compromises. Organizations running Ivanti Sentry should prioritize upgrading to R10.5.2, R10.6.2, or R10.7.1 or newer, as appropriate for their release branch, and restrict external access to administration endpoints to reduce exposure.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CrowdSec observed the first exploitation attempts against CVE-2026-10520, one day after its publication. Initial activity included a rapid spike in scanning for vulnerable, internet-exposed Ivanti Sentry instances.
CVE-2026-10520 was published with a reported CVSS score of 10.0. The pre-authentication vulnerability allows attackers to execute arbitrary operating-system commands with root privileges on Ivanti Sentry.
CrowdSec made indicators of compromise available for malicious HTTP path patterns associated with attempts to exploit CVE-2026-10520.
CrowdSec promptly released detection rules after observing attempts to exploit CVE-2026-10520.
The vulnerability was remediated in Ivanti Sentry R10.5.2, R10.6.2, and R10.7.1 or newer. The source recommends upgrading immediately and restricting external access to administration endpoints.
watchTowr Labs published a comprehensive disclosure of the vulnerability. The reported attack mechanism involves crafted HTTP POST requests containing malicious commands in the message parameter at /mics/api/v2/sentry/mics-config/handleMessage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
crowdsec.net
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Ivanti Sentry vulnerability, **CVE-2026-10520**, is being actively exploited to achieve unauthenticated remote code execution with **root** privileges through OS command injection. The flaw stems from improper handling of internal configuration commands exposed through an externally accessible API, allowing full compromise of affected appliances. CISA added the bug to its **Known Exploited Vulnerabilities** catalog, and FortiGuard reported **886** blocked exploitation attempts in 24 hours and **8,406** over seven days, with activity rising **82%** week over week across the technology, automotive, banking/finance/insurance, and education sectors. The vulnerability affects Ivanti Sentry versions before **10.5.2**, **10.6.2**, and **10.7.1**, and Ivanti has released those versions as fixes. Because Sentry operates as an inline gateway between mobile devices and enterprise back-end systems, successful exploitation can expose a critical network chokepoint and enable broad downstream access. Ivanti also addressed **CVE-2026-10523** in the same update, though it was not reported as exploited, and defenders are being urged to upgrade immediately and restrict management and service interfaces from untrusted networks.
Jul 10, 2026
Ivanti disclosed two severe vulnerabilities in **Ivanti Sentry** that allow remote compromise of exposed appliances. **`CVE-2026-10520`** is an OS command injection flaw (`CWE-78`) that can let an unauthenticated attacker achieve **root-level remote code execution**, while **`CVE-2026-10523`** is an authentication bypass (`CWE-288`) that can be used to create arbitrary administrative accounts and obtain full administrative access. Both issues affect Ivanti Sentry versions earlier than **R10.5.2**, **R10.6.2**, and **R10.7.1**. The vulnerabilities carry severe impact ratings, with `CVE-2026-10520` described as critical and `CVE-2026-10523` as high severity, reflecting risks to confidentiality, integrity, and availability. Ivanti said the flaws were addressed in **R10.5.2**, **R10.6.2**, and **R10.7.1**, and published a security advisory covering both CVEs, making patching of affected Sentry deployments an immediate priority.
Aug 31, 2026
Ivanti released fixes for ten vulnerabilities across **Endpoint Manager Mobile (EPMM)**, **Neurons for ITSM**, and **Sentry**. The most urgent Neurons for ITSM issues are unauthenticated deserialization flaws `CVE-2026-12744` and `CVE-2026-12745`, which can enable remote code execution on versions before 2026.2; additional missing-authorization and deserialization flaws, including `CVE-2026-12646`, `CVE-2026-12647`, `CVE-2026-12648`, `CVE-2026-12650`, and `CVE-2026-12651`, allow low-privileged authenticated users to execute code. Ivanti patched its cloud/SaaS ITSM environments and directed on-premises customers on versions 2025.2 through 2026.1 to apply the September security updates. EPMM vulnerability `CVE-2026-18851` is a CVSS 8.8 missing-authorization flaw that lets a remote authenticated attacker elevate privileges to administrator; affected customers should upgrade to 12.10.0.0, 12.9.0.2, or 12.8.0.4. Ivanti Sentry vulnerability `CVE-2026-83527` permits unauthenticated attackers to gain administrative-level access in releases before R10.8.2, R10.7.3, and R10.6.4. Ivanti and CISA reported no known exploitation at disclosure, but organizations should prioritize remediation of internet-exposed Neurons for ITSM deployments and review all applicable vendor advisories.
Sep 11, 2026