An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Exploitation of a command injection flaw in Ivanti Sentry has been observed 24 hours after public PoC became available. Apply the available patches as soon as possible.

Exploitation has been observed for this OS command injection affecting Ivanti Sentry. Patches should be applied as soon as possible.

This maximum severity vulnerability affecting Ivanti Sentry should be patched as soon as possible. Ivanti products are routinely targeted by threat actors.

Invanti Sentry version prior to R10.5.2, R10.6.2 and R10.7.1 is vulnerable to OS Command Injection, which allows a remote unauthenticated user to achieve root-level remote code execution.

The version of Ivanti Sentry (formerly MobileIron Sentry) running on the remote host is prior to R10.5.2, R10.6.2, or R10.7.1. It is, therefore, affected by multiple vulnerabilities :

  - An OS command injection vulnerability allows a remote, unauthenticated attacker to achieve root-level remote     code execution. (CVE-2026-10520)

  - An authentication bypass vulnerability (CWE-288) allows a remote, unauthenticated attacker to create arbitrary     administrative accounts and obtain full administrative access. (CVE-2026-10523)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115267	Ivanti Sentry < 10.5.2 / 10.6.x < 10.6.2 / 10.7.x < 10.7.1 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
320765	Ivanti Sentry < R10.5.2 / R10.6.2 / R10.7.1 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-10520

critical

Tenable Plugins

critical

critical