IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ivanti Standalone Sentry: OS command injection leading to root remote code execution

CVE-2026-10520Critical 10.0Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 11 Jun 2026
Deadline for US federal agencies: 14 Jun 2026

Summary

Ivanti Standalone Sentry contains an OS command injection flaw (CWE-78) that allows a remote, unauthenticated attacker to execute commands with root privileges. The CVSS base score is 10.0 (critical). CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, and a public proof-of-concept exists, so exposed instances should be treated as urgent.

Affected

  • Ivanti Standalone Sentry versions before R10.5.2, R10.6.2 and R10.7.1 (per the CVE record)
  • Exact affected version ranges: Unknown. Secondary sources differ in detail and must be checked against the Ivanti advisory.

Fixed in

  • Ivanti Standalone Sentry R10.5.2, R10.6.2 and R10.7.1 or later

Workaround

  • No workaround from Ivanti verified.
  • Restrict network access to Sentry so that the management and MICS API endpoints are not reachable from the internet.
  • Interim measures are detection aids, not a substitute for patching.

Exploitation

  • Public proof-of-concept published on June 10, 2026 (watchTowr).
  • Added to the CISA KEV catalog on June 11, 2026, based on evidence of active exploitation.
  • Shadowserver reported exploitation attempts based on the public proof-of-concept.
  • Exploitation requires no authentication. CISA SSVC rates automatable: yes, technical impact: total.

Our recommendation

  • Identify all Sentry instances and confirm their versions.
  • Patch to R10.5.2, R10.6.2 or R10.7.1 as soon as possible, and within the CISA deadline of June 14, 2026.
  • Remove internet exposure of the affected endpoints until patching is complete.
  • If a vulnerable instance was internet-reachable, review logs for unauthenticated POST requests to /mics/api/v2/sentry/mics-config/handleMessage, check for unexpected child processes and outbound connections, and assume compromise if indicators are found. Rebuild affected systems if in doubt.
  • Check the Ivanti advisory for the latest guidance.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:51.

Original description (NVD)

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed