Full Report
Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways. [...]
Analysis Summary
This summary describes the maximum-severity vulnerability affecting Ivanti Sentry as detailed in the provided report.
# Vulnerability: Ivanti Sentry OS Command Injection
## CVE Details
- **CVE ID:** CVE-2026-10520
- **CVSS Score:** 10.0 (Critical)
- **CWE:** OS Command Injection (CWE-78)
## Affected Systems
- **Products:** Ivanti Sentry (formerly MobileIron Sentry)
- **Versions:** Versions prior to R10.5.2, R10.6.2, and R10.7.1
- **Configurations:** Systems with management interfaces or secure mobile gateways exposed to the Internet.
## Vulnerability Description
The flaw is an OS command injection vulnerability. It allows an unauthenticated attacker to execute arbitrary commands with root-level privileges on the underlying operating system of the Ivanti Sentry appliance. This occurs because the application fails to properly neutralize user-supplied input before it is used in a command that is executed by the system shell.
## Exploitation
- **Status:** Exploited in the wild; Public PoC available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to system data and traffic)
- **Integrity:** High (Ability to modify system files and plant backdoors)
- **Availability:** High (Potential for complete system takeover or shutdown)
## Remediation
### Patches
Ivanti has released the following security updates to address this flaw. Administrators should upgrade to these versions (or later) immediately:
- Ivanti Sentry R10.5.2
- Ivanti Sentry R10.6.2
- Ivanti Sentry R10.7.1
### Workarounds
- **Access Control:** Restrict access to the Ivanti Sentry administrator portal. Ensure it is not reachable from the public internet and is only accessible via a management network or VPN.
- **Monitoring:** Monitor for unauthorized configuration changes or unusual outbound traffic from the appliance.
## Detection
- **Indicators of Compromise:** Shadowserver reports that compromised instances may be backdoored. Look for unauthorized web shells, new administrative users, or suspicious processes running with root privileges.
- **Detection Methods:** Vulnerability scanners can identify outdated versions of Sentry. Organizations should check system logs for command execution attempts targeting the admin interface.
## References
- Ivanti Security Advisory: hxxps[://]www[.]ivanti[.]com/blog/topics/security-advisory
- NVD CVE-2026-10520: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-10520
- BleepingComputer Report: hxxps[://]www[.]bleepingcomputer[.]com/news/security/max-severity-ivanti-sentry-vulnerability-now-exploited-in-attacks/