Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Spring Framework Patches Critical Flaws, Urges Immediate Upgrade

Part of the CVE-2026-10520 story · since 10 Jun

Quiet for 15 weekslast report 20 Jul13 articles7 outlets
10 Jun · SecurityOnline first23 Aug17 Sep12 OctNowThis article9th of 13
  • Wed 10 Jun, 06:10 UTC. SecurityOnline, first report. Ivanti patches CVE-2026-10520 gateway flaw after urgent alert. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 09:11 UTC. SecurityWeek, its first report on the story. Critical Vulnerabilities Patched in Fortinet, Ivanti Products. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 11:30 UTC. Rapid7, its first report on the story. CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:52 UTC. SOCRadar, its first report on the story. CVE-2026-10520 lets hackers run root on Ivanti Sentry. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 18:31 UTC. Security Affairs, its first report on the story. Ivanti Sentry gateways compromised by CVE-2026-10520 injection bug. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 19:40 UTC. Dark Reading, its first report on the story. Critical Ivanti Sentry flaw exploited 24 hours after disclosure. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 19:44 UTC. CISA, its first report on the story. CISA warns of Ivanti Sentry flaw granting remote root access. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:16 UTC. CISA. CISA Adds Ivanti Sentry Command Injection Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:30 UTC. SecurityOnline. Spring Framework Patches Critical Flaws, Urges Immediate Upgrade. Cites a CVE in CISA KEV. This article, 9th of 13.
  • Fri 12 Jun, 10:11 UTC. SecurityWeek. Ivanti Sentry Exploitation Attempts Hitting Honeypots. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:51 UTC. Security Affairs. CISA urges immediate patch for Ivanti Sentry CVE-2026-10520 flaw. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CISA warns of active exploits in Ivanti, Cisco, Oracle and Chrome. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 21:20 UTC. Dark Reading. Ivanti Deploys AI to Uncover Hidden Flaws Like CVE-2026-10520. Cites a CVE in CISA KEV.

The page details critical security updates targeting multiple vulnerabilities within the Spring framework. Key entries include CVE-2026-10520, a command injection vulnerability in Ivanti Sentry, and CVE-2026-41003, which addresses cross-site scripting flaws in authentication filters. Several severe issues related to outbound connection flaws (CVE-2026-40999) and XML External Entity attacks (CVE-2026-40998) were also noted. Developers are urged to upgrade to latest versions (7.0.6 or 6.5.11) to mitigate these risks and secure enterprise data against exploitation.

How the story developed

All 13 articles
Quiet for 15 weekslast report 20 Jul13 articles7 outlets

13 articles from 7 outlets since 10 Jun. Quiet since 20 Jul. This was the 9th report, 2 days after the first.

Now10 Jun12141620 Jul22First reportSecurityOnline · 10 Jun, 06:10This article9th of 13 · day 2
  • Wed 10 Jun, 06:10 UTC. SecurityOnline, first report. Ivanti patches CVE-2026-10520 gateway flaw after urgent alert. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 09:11 UTC. SecurityWeek, its first report on the story. Critical Vulnerabilities Patched in Fortinet, Ivanti Products. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 11:30 UTC. Rapid7, its first report on the story. CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry. Cites a CVE in CISA KEV.
  • Wed 10 Jun, 14:52 UTC. SOCRadar, its first report on the story. CVE-2026-10520 lets hackers run root on Ivanti Sentry. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 18:31 UTC. Security Affairs, its first report on the story. Ivanti Sentry gateways compromised by CVE-2026-10520 injection bug. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 19:40 UTC. Dark Reading, its first report on the story. Critical Ivanti Sentry flaw exploited 24 hours after disclosure. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 19:44 UTC. CISA, its first report on the story. CISA warns of Ivanti Sentry flaw granting remote root access. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 21:16 UTC. CISA. CISA Adds Ivanti Sentry Command Injection Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 03:30 UTC. SecurityOnline. Spring Framework Patches Critical Flaws, Urges Immediate Upgrade. Cites a CVE in CISA KEV. This article, 9th of 13.
  • Fri 12 Jun, 10:11 UTC. SecurityWeek. Ivanti Sentry Exploitation Attempts Hitting Honeypots. Cites a CVE in CISA KEV.
  • Fri 12 Jun, 19:51 UTC. Security Affairs. CISA urges immediate patch for Ivanti Sentry CVE-2026-10520 flaw. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 02:10 UTC. SecurityOnline. CISA warns of active exploits in Ivanti, Cisco, Oracle and Chrome. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 21:20 UTC. Dark Reading. Ivanti Deploys AI to Uncover Hidden Flaws Like CVE-2026-10520. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Wed 10 JunDay 04
    1. Ivanti patches CVE-2026-10520 gateway flaw after urgent alert06:10 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Critical Vulnerabilities Patched in Fortinet, Ivanti Products09:11 · SecurityWeek · Known exploited CVE
    3. CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry11:30 · Rapid7 · Known exploited CVE
    4. CVE-2026-10520 lets hackers run root on Ivanti Sentry14:52 · SOCRadar · Known exploited CVE
  2. Thu 11 JunDay 14
    1. Ivanti Sentry gateways compromised by CVE-2026-10520 injection bug18:31 · Security Affairs · Known exploited CVE
    2. Critical Ivanti Sentry flaw exploited 24 hours after disclosure19:40 · Dark Reading · Known exploited CVE
    3. CISA warns of Ivanti Sentry flaw granting remote root access19:44 · CISA · official · CISA alert · Known exploited CVE
    4. CISA Adds Ivanti Sentry Command Injection Flaw to KEV Catalogue21:16 · CISA · official · Known exploited CVE
  3. Fri 12 JunDay 23
    1. Spring Framework Patches Critical Flaws, Urges Immediate Upgrade03:30 · SecurityOnline · Known exploited CVE · This article, 9th of 13
    2. Ivanti Sentry Exploitation Attempts Hitting Honeypots10:11 · SecurityWeek · Known exploited CVE
    3. CISA urges immediate patch for Ivanti Sentry CVE-2026-10520 flaw19:51 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 15 JunDay 51
    1. CISA warns of active exploits in Ivanti, Cisco, Oracle and Chrome02:10 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 5 weeks

    Mon 20 JulDay 401
    1. Ivanti Deploys AI to Uncover Hidden Flaws Like CVE-2026-1052021:20 · Dark Reading · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in