External risk intelligence

Ivanti Sentry OS Command Injection Leads to Remote Code Execution.

CVE advisoryKnown Exploit

CVE-2026-10520

Ivanti Sentry is an edge appliance designed to act as a gateway for mobile device management and secure access. By design, such appliances are typically deployed in positions that are public-facing or internet-accessible to facilitate remote connectivity for enterprise infrastructure, making this surface inherently and commonly exposed to the internet.

OS Command Injection

Ivanti Standalone Sentry

before 10.5.210.6.0 to before 10.6.210.7.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Ivanti Sentry, a technology used for mobile device management and secure access. This issue could allow unauthorized remote attackers to execute code at the highest privilege level on affected systems. The primary concern is to confirm if our organization utilizes this specific technology and if it is exposed in a manner that could be targeted.

Unauthenticated attackers can run any code remotely.
It affects Ivanti Sentry, used for secure remote access.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request over the network to an exposed Ivanti Sentry appliance. This request targets a weakness in how the appliance processes certain commands, allowing the attacker to inject malicious operating system commands. Successful exploitation could grant the attacker root-level control over the affected system, enabling them to execute arbitrary code.

Unauthenticated network access required.
Vulnerable command processing triggers injection.
Root-level code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could achieve root-level remote code execution on Ivanti Sentry systems. This could occur when specific conditions are met, potentially impacting the confidentiality, integrity, and availability of the affected system.

System access and control.
Via network; unauthenticated.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS Command Injection vulnerability impacts Ivanti Sentry, suggesting that platform or infrastructure teams responsible for managing the Ivanti deployment, along with the network or security teams overseeing external-facing services, are likely involved. The immediate first step should be to identify all instances of Ivanti Sentry, confirm their external reachability and business criticality, and then locate the designated owner for remediation planning.

Identify and confirm affected systems.
Verify external reachability and criticality.
Plan remediation with the owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Sentry?

Ivanti Sentry is a specialized network gateway appliance. Organizations use it to manage secure connectivity between mobile devices and internal enterprise infrastructure, often acting as a bridge for authentication and data flow.

What does OS Command Injection mean for CVE-2026-10520?

This vulnerability falls under the CWE-78 weakness class. It occurs when software improperly cleans inputs, allowing an attacker to insert and execute their own operating system commands. Because this flaw exists at the root level, an attacker could potentially gain full control over the affected appliance.

How does an attacker trigger this vulnerability?

An attacker can exploit this remotely without needing any prior authentication or credentials. The flaw is triggered by sending specially crafted network requests to the appliance. Standard administrative actions performed by authorized users through the intended management interface do not trigger this specific command injection bug.

Why is my Ivanti Sentry device relevant to this CVE?

Halo Surface Signal indicates that Ivanti Sentry appliances are frequently deployed in internet-accessible positions to support remote connectivity. If your device is reachable via the public internet, it falls into the high-risk category for this vulnerability because the attack vector is network-based.

Do I need to update my software for CVE-2026-10520?

Yes. The first step is to verify if your current version is earlier than R10.5.2, R10.6.2, or R10.7.1. If you are running an older version, you should prioritize applying the vendor-provided security updates to address the underlying vulnerability and prevent unauthorized remote code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.