Known vulnerability record
CVE-2026-10520
Ivanti Sentry OS Command Injection Vulnerability
Summary
Ivanti Sentry OS Command Injection Vulnerability
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
Signals
Keep the signals separate
CVSS severitycriticalScore 10 · source ivanti
EPSS probability99.9%Probability of exploitation in the next 30 days; not severity
CISA KEVKnown exploitedAdded 2026-06-11
Ransomware useunknownPreserved as known / unknown, not a truthy default
Timeline
Dates and provenance
- CVE published
- 2026-06-09
- CVE modified
- 2026-06-12
- KEV date added
- 2026-06-11
- Dataset fetched
- 2026-08-21T03:55:02.403Z
Sources
Original records
- https://www.cve.org/CVERecord?id=CVE-2026-10520 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-10520 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520 ↗
Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.