Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)

1. Apply Official Security Patches

Apply the official security updates provided by Ivanti to upgrade to a non-vulnerable version.

• Ivanti Sentry R10.5.x Users: Upgrade to R10.5.2 or higher
• Ivanti Sentry R10.6.x Users: Upgrade to R10.6.2 or higher
• Ivanti Sentry R10.7.x Users: Upgrade to R10.7.1 or higher

2. Temporary Mitigations (Prior to Patching)

If immediate patching is not feasible, implement the following network-level mitigations:

• Network Segmentation & Access Control: Restrict access to Ivanti Sentry management interfaces and service ports. Ensure they are not exposed to the public internet and are only accessible via trusted internal networks or secure VPNs.
• IPS/WAF Signature Deployment: Enable intrusion prevention system (IPS) or web application firewall (WAF) rules to detect and block malicious payloads containing OS command injection patterns.

An OS Command Injection vulnerability (CWE-78) exists in Ivanti Sentry due to insufficient validation of user-supplied input. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted network requests to execute arbitrary operating system commands with root-level privileges.

This vulnerability has been assigned a CVSS 3.1 score of 10.0 (Critical), reflecting its low attack complexity (AC:L) and lack of user interaction requirements (UI:N). It is currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and carries an extremely high EPSS score of 0.94, demanding immediate remediation.