CVE catalog

CVE-2026-10520

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

[CVE catalog]

Severity
Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
99.91% · Oct 25, 2026

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpestandalone_sentryNot reported10.5.2fixed
Cpestandalone_sentryNot reported10.6.2fixed
Cpestandalone_sentryNot reportedNot reportedunknown
Cpestandalone_sentryNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpestandalone_sentrycpeNot reported10.5.2Not reportedNot reportedNot reported
Cpestandalone_sentrycpeNot reported10.6.2Not reportedNot reportedNot reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]