SECURELYN
Free ScanFree consultation

CVE-2026-10520

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Scores

10.0
CVSS 10.0 out of 10, critical severity.
99.9%
EPSS 99.9% chance of exploitation in the next 30 days.

The facts

Published
9 June 2026
Last changed
7 October 2026
NVD status
Analyzed
Severity
Critical, CVSS 10.0 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
Affects
  • ivanti standalone sentry
Known exploited
Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 June 2026.
EPSS
99.9% chance of exploitation activity in the next 30 days (percentile 100).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References