CVE-2026-10520 Ivanti Sentry OS Command Injection

Exploited in the wild Critical 10.0 Published 9 Jun 2026 Updated 7 Oct 2026

Remote unauthenticated attackers can execute arbitrary commands with root privileges on Ivanti Sentry devices.

Exploited in the wild: Since 11 Jun 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-10520?

CVE-2026-10520 is a critical command injection vulnerability in ivanti Sentry, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Weakness: CWE-78

Which versions are affected by CVE-2026-10520?

It affects 1 product.

Products include Ivanti Standalone Sentry.

How do I fix CVE-2026-10520?

No fix has been published for CVE-2026-10520 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Jun 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-10520 being exploited?

Yes. Attackers have exploited CVE-2026-10520 in the wild since at least 11 Jun 2026.

Public exploit code: 1 Nuclei template and 8 proofs of concept on GitHub.

Sources

Also known as GHSA-v2vc-rgvq-3pwf.