CVE-2026-10520
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
CISA Known Exploited Vulnerability
Vendor / Product
Ivanti — Sentry
Date Added
2026-06-11
Remediation Due
2026-06-14
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-10520
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| ivanti | standalone_sentry | < 10.5.2 |
| ivanti | standalone_sentry | 10.6.0 – 10.6.2 |
| ivanti | standalone_sentry | 10.7.0 |
References & Advisories (3)
US Government Resource
Third Party Advisory
Patch
Vendor Advisory