Vulnerability intelligence
CVE-2026-10520
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVSS Score
10
Critical
EPSS — Exploit Probability
100%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-06-11
Remediation
Patch available
Federal deadline 2026-06-14
13 articles across 8 outlets · first covered Jun 10, 2026 · latest Jul 20, 2026
Tracked incidents
Coverage timeline
-
Ivanti Deploys AI to Uncover Hidden Flaws Like CVE-2026-10520www.darkreading.com · Jul 20, 2026
-
CISA warns of active exploits in Ivanti, Cisco, Oracle and Chromesecurityonline.info · Jun 15, 2026
-
CISA urges immediate patch for Ivanti Sentry CVE-2026-10520 flawsecurityaffairs.com · Jun 12, 2026
-
Ivanti Sentry Exploitation Attempts Hitting Honeypotswww.securityweek.com · Jun 12, 2026
-
Spring Framework Patches Critical Flaws, Urges Immediate Upgradesecurityonline.info · Jun 12, 2026
-
CISA Adds Ivanti Sentry Command Injection Flaw to KEV Cataloguewww.cisa.gov · Jun 11, 2026
-
CISA warns of Ivanti Sentry flaw granting remote root accesscisa.gov · Jun 11, 2026
-
Critical Ivanti Sentry flaw exploited 24 hours after disclosurewww.darkreading.com · Jun 11, 2026
-
Ivanti Sentry gateways compromised by CVE-2026-10520 injection bugsecurityaffairs.com · Jun 11, 2026
-
CVE-2026-10520 lets hackers run root on Ivanti Sentrysocradar.io · Jun 10, 2026
-
CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentrywww.rapid7.com · Jun 10, 2026
-
Critical Vulnerabilities Patched in Fortinet, Ivanti Productswww.securityweek.com · Jun 10, 2026
-
Ivanti patches CVE-2026-10520 gateway flaw after urgent alertsecurityonline.info · Jun 10, 2026