CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch Release
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10520 | Unauthenticated OS Command Injection in Ivanti Sentry | 10.0 | 100% | KEVPoC | KEV |
| CVE-2026-1340 | Unauthenticated Code Injection RCE in Ivanti Endpoint Manager Mobile | 9.8 | 99% | KEV | KEV |
| CVE-2026-1603 | Authentication Bypass in Ivanti Endpoint Manager Leaks Stored Credentials | 7.5 | 88% | KEV | KEV |
From the original article
2 min read at securityaffairs.comAttackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges. “An OS Command Injection vulnerability in Ivanti Sentry before the R10.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.