OS Command Injection in Ivanti Sentry

Publication date: 2026-06-09

Last updated on: 2026-06-12

Assigner: ivanti

Description

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-12

Generated

2026-06-30

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-10520

EUVD

EUVD-2026-35440

Affected Vendors & Products

Vendor	Product	Version / Range
ivanti	standalone_sentry	to 10.5.2 (exc)
ivanti	standalone_sentry	From 10.6.0 (inc) to 10.6.2 (exc)
ivanti	standalone_sentry	10.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS Command Injection issue in Ivanti Sentry versions before R10.5.2, R10.6.2, and R10.7.1. It allows a remote unauthenticated user to execute commands on the operating system with root-level privileges.

Impact Analysis

The vulnerability can have a severe impact as it allows an attacker to remotely execute code with root-level access without any authentication. This can lead to complete system compromise, including unauthorized data access, modification, or destruction, and potentially control over the affected system.

Hi! I’m here to help you understand CVE-2026-10520. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70