peter bassill · operator
$ cve CVE-2026-10520 JSON

CVE-2026-10520 KEV

10.0
CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2026-06-14.

Description

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Scoring

CVSS10.0 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS99.92% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2026-06-14
Public exploitnone known
Published2026-06-09
Last modified2026-07-23

CISA KEV

NameIvanti Sentry OS Command Injection Vulnerability
Added2026-06-11
Due2026-06-14
Vendor / productIvanti / Sentry
Ransomware usenone reported

Affected (1)

VendorProduct
ivantistandalone sentry

References

→ the Explorer  ·  watch your stack  ·  NVD