{"id":"ivanti-sentry-command-injection-jun-2026","category":"patch","status":"closed","title":"Ivanti Sentry command injection CVE-2026-10520 used in attacks; fixes available","tldr":"Attackers are exploiting CVE-2026-10520 to take over exposed Ivanti Sentry business gateways without logging in. Ask IT to install R10.5.2, R10.6.2 or R10.7.1 or later, restrict access and check for compromise.","summary":"Ivanti Sentry, formerly MobileIron Sentry, is a business gateway between mobile devices and corporate systems such as email servers. CVE-2026-10520 lets a remote attacker who can reach the vulnerable interface run code with full system privileges without logging in. Ivanti disclosed the flaw on 9 June and identifies R10.5.2, R10.6.2 and R10.7.1 as fixed releases. Although Ivanti initially reported no known customer exploitation, CISA confirmed exploitation by adding it to its catalogue on 11 June. Shadowserver also reported backdoored appliances, and its feed recorded further attack attempts on 19 July. The reviewed sources do not establish the total number of victims or that attacks have ended. As of 3 November, the identified fixes remain available. Ivanti's advisory portal could not be retrieved during verification; version details come from its published CVE record.","action":"If your workplace or family office uses Ivanti Sentry, ask IT to update to R10.5.2, R10.6.2 or R10.7.1 or a later supported release, restrict access to its management interfaces and investigate possible compromise. Families do not need to update their phones for this flaw; the affected system is the organisation's gateway.","product":"Ivanti Sentry (formerly MobileIron Sentry)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-10520"],"tags":["ivanti","sentry","mobileiron","command-injection","actively-exploited"],"affected":["Ivanti Sentry 10.5.1 and earlier","Ivanti Sentry 10.6.1 and earlier in the 10.6 branch","Ivanti Sentry 10.7.0"],"fixed":["Ivanti Sentry R10.5.2","Ivanti Sentry R10.6.2","Ivanti Sentry R10.7.1"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-10520 — Ivanti-authored CVE record","url":"https://www.cve.org/CVERecord?id=CVE-2026-10520","by":"Ivanti","date":"2026-06-09"},{"kind":"advisory","title":"Critical vulnerabilities in Ivanti Sentry","url":"https://cert.europa.eu/publications/security-advisories/2026-008/","by":"CERT-EU","date":"2026-06-10"},{"kind":"news","title":"Ivanti: Max severity Sentry flaw allows code execution as root","url":"https://www.bleepingcomputer.com/news/security/new-max-severity-ivanti-sentry-flaw-allows-code-execution-as-root/","by":"BleepingComputer","date":"2026-06-10"},{"kind":"news","title":"Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)","url":"https://www.helpnetsecurity.com/2026/06/10/ivanti-sentry-cve-2026-10520-cve-2026-10523/","by":"Help Net Security","date":"2026-06-11"},{"kind":"advisory","title":"Ivanti Releases Security Advisory for Critical Vulnerabilities in Sentry","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4795","by":"NHS England","date":"2026-06-11"},{"kind":"advisory","title":"CVE-2026-10520 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-10520","by":"NIST","date":"2026-06-09"},{"kind":"research","title":"CVE-2026-10520 — Shadowserver exploitation observations","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/36e24aa2-07e7-451d-90f5-968b387cebf9","by":"CIRCL","date":"2026-07-21"}],"started":"2026-06-09","closed":"2026-07-19","created":"2026-11-03T22:19:09.657Z","updated":"2026-11-03T22:19:09.657Z","cve_notes":[{"cve":"CVE-2026-10520","name":"OS command injection in Ivanti Sentry","what":"An operating system command injection flaw in Ivanti Sentry allows a remote attacker to run code with full system privileges without logging in.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-07-19","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"A Shadowserver feed entry reproduced by CIRCL recorded 18 honeypot connections associated with exploitation attempts that day. This indicates continued attempts, rather than 18 confirmed compromises.","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/36e24aa2-07e7-451d-90f5-968b387cebf9","by":"CIRCL","patch":null},{"at":"2026-06-11","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 14 June for US federal civilian agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2026-10520","by":"NIST","patch":null},{"at":"2026-06-11","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Help Net Security reported Shadowserver's observation of widespread exploitation attempts. Shadowserver had identified 19 vulnerable instances, at least two with backdoors.","url":"https://www.helpnetsecurity.com/2026/06/10/ivanti-sentry-cve-2026-10520-cve-2026-10523/","by":"Help Net Security","patch":null},{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Ivanti disclosed CVE-2026-10520, which lets an attacker run code with full system privileges without logging in. Its CVE record identifies R10.5.2, R10.6.2 and R10.7.1 as fixed versions.","url":"https://www.cve.org/CVERecord?id=CVE-2026-10520","by":"Ivanti","patch":"patched"}],"url":"https://hard.fyi/live/ivanti-sentry-command-injection-jun-2026/","json":"https://hard.fyi/api/live?id=ivanti-sentry-command-injection-jun-2026"}