2026-008: Critical vulnerabilities in Ivanti Sentry
Ivanti patched Sentry: pre-auth OS command injection CVE-2026-10520 (CVSS 10) enables unauthenticated root RCE, and auth bypass CVE-2026-10523 (CVSS 9.9).
On 9 June 2026 Ivanti released an advisory fixing two critical flaws in Ivanti Sentry versions 10.5.1 and prior, 10.6.1 and prior, and 10.7.0 and prior. CVE-2026-10520 (CVSS 10.0) is an OS command injection allowing a remote unauthenticated attacker to achieve root-level RCE. CVE-2026-10523 (CVSS 9.9) is an authentication bypass letting an unauthenticated attacker create arbitrary administrative accounts and obtain full admin access. CERT-EU recommends updating appliances to fixed versions following Ivanti's guidance.
- CVE-2026-10520 (CVSS 10): unauthenticated OS command injection to root-level RCE
- CVE-2026-10523 (CVSS 9.9): authentication bypass enabling arbitrary admin account creation
- Affects Ivanti Sentry 10.5.1, 10.6.1, and 10.7.0 and prior
- Fixed versions available; patch appliances per Ivanti guidance
- Vendors
- Ivanti
- Products
- Ivanti Sentry
- Organizations
- CERT-EU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10520 | Unauthenticated OS Command Injection in Ivanti Sentry | 10.0 | 100% | KEVPoC | KEV |
| CVE-2026-10523 | Unauthenticated Authentication Bypass in Ivanti Sentry Grants Full Admin Access | 9.8 | 52% |
From the original article
1 min read at cert.europa.eu
On 9 June 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their Sentry products[1]. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.