embedded-device-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerabilityperimeter-device-exposure

Critical Ivanti Sentry Flaws Enable Root RCE and Admin Account Creation

Vulnerability Disclosure · 30 sources · Updated 2mo ago · First seen Jun 9, 2026

Ivanti disclosed two severe vulnerabilities in Ivanti Sentry that allow remote compromise of exposed appliances. CVE-2026-10520 is an OS command injection flaw (CWE-78) that can let an unauthenticated attacker achieve root-level remote code execution, while CVE-2026-10523 is an authentication bypass (CWE-288) that can be used to create arbitrary administrative accounts and obtain full administrative access. Both issues affect Ivanti Sentry versions earlier than R10.5.2, R10.6.2, and R10.7.1.

The vulnerabilities carry severe impact ratings, with CVE-2026-10520 described as critical and CVE-2026-10523 as high severity, reflecting risks to confidentiality, integrity, and availability. Ivanti said the flaws were addressed in R10.5.2, R10.6.2, and R10.7.1, and published a security advisory covering both CVEs, making patching of affected Sentry deployments an immediate priority.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jun 9, 2026 – Jun 11, 2026

Jun 11, 20265mo ago
Public CVE-2026-10523 PoC reveals different attack path
Public proof-of-concept code for Ivanti Sentry authentication-bypass flaw CVE-2026-10523 became available on 2026-06-11. The NCSC said the disclosed attack path differed from the one it had originally described and raised its exploitation-likelihood and impact assessment to High/High.
Ontwikkeling in Ivanti Sentry kwetsbaarheid | NCSC
Jun 11, 20265mo ago
CISA adds CVE-2026-10520 to KEV catalog
On 2026-06-11, CISA added Ivanti Sentry vulnerability CVE-2026-10520 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The notice directed Federal Civilian Executive Branch agencies to prioritize remediation under Binding Operational Directive 26-04 and assess whether systems were compromised before patching.
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
Jun 11, 20265mo ago
Shadowserver reports active exploitation of CVE-2026-10520
Shadowserver reported that attackers were actively exploiting Ivanti Sentry flaw CVE-2026-10520 after a public proof-of-concept became available. It said exploitation attempts surged and that many exposed Sentry gateways were likely already backdoored or compromised.
Max severity Ivanti Sentry vulnerability now exploited in attacks
Jun 11, 20265mo ago
Ivanti advisory also covers two EPMM vulnerabilities
Ivanti's June 2026 advisory also described two Ivanti EPMM flaws, CVE-2026-6973 and CVE-2026-10727, involving Apache directive injection or command execution paths that require administrator authentication. The reference states CVE-2026-6973 was already listed in CISA KEV as actively exploited, while Ivanti said there was no known public exploitation of CVE-2026-10727 at disclosure.
Ivanti June 2026 - Vulnerability Advisory Deep Dive - TheCyberThrone
Jun 10, 20265mo ago
watchTowr Labs publishes public PoC for Ivanti Sentry flaws
watchTowr Labs published technical analysis and a public proof-of-concept exploit for CVE-2026-10520 and CVE-2026-10523, lowering the barrier to exploitation of the Ivanti Sentry vulnerabilities. The report also noted Ivanti said it was not aware of customer exploitation at the time of disclosure.
Ivanti Sentry RCE: Publicly Disclosed PoC for CVSS 10
Jun 9, 20265mo ago
Ivanti publishes Sentry advisory and fixed versions
Ivanti published a security advisory covering CVE-2026-10520 and CVE-2026-10523 and stated that fixes are available in Ivanti Sentry versions R10.5.2, R10.6.2, and R10.7.1. The advisory confirms affected versions are those prior to these releases.
CVE-2026-10523 - Ivanti Sentry Authentication Bypass
Jun 9, 20265mo ago
Ivanti discloses CVE-2026-10523 authentication bypass in Sentry
On 2026-06-09, CVE-2026-10523 was disclosed as an authentication bypass in Ivanti Sentry affecting versions before R10.5.2, R10.6.2, and R10.7.1. A remote unauthenticated attacker could create arbitrary administrative accounts and gain full administrative access.
CVE-2026-10523 - Ivanti Sentry Authentication Bypass
Jun 9, 20265mo ago
Ivanti records CVE-2026-10520 for Sentry command injection
On 2026-06-09, CVE-2026-10520 was recorded as an OS command injection vulnerability in Ivanti Sentry affecting versions before R10.5.2, R10.6.2, and R10.7.1. The flaw allows a remote unauthenticated attacker to achieve root-level remote code execution.
CVE-2026-10520 - Ivanti Sentry OS Command Injection

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Authentication Bypass and Administrative Account Creation in Ivanti Sentry (CVE-2026-10523)Unauthenticated Root-Level Command Injection in Ivanti Sentry (CVE-2026-10520)

Affected products

1 linked

Sentry

Organizations

1 linked

Ivanti

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

30 references tracked. Mallory keeps watching after this page renders.

Fortinet Threat SignalNews · Jul 2, 2026

Threat Signal Report | FortiGuard LabsOpen source ↗

Csirt SkNews · Jun 15, 2026

Kritické zraniteľnosti v produkte Ivanti Sentry | CSIRT.SKOpen source ↗

ScworldNews · Jun 12, 2026

CISA gives agencies 3 days to patch maximum severity Ivanti vulnerability | news | SC MediaOpen source ↗

Security AffairsNews · Jun 12, 2026

U.S. CISA adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog and urges patching by June 14 - Security AffairsOpen source ↗

22 additional sources from 10-06-2026 to 12-06-2026

Github WebNews · Jun 9, 2026

GitHub - watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523 · GitHubOpen source ↗

Hub IvantiNews · Jun 9, 2026

Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)Open source ↗

Cvefeed High SeverityAdvisories · Jun 9, 2026

CVE-2026-10520 - Ivanti Sentry OS Command InjectionOpen source ↗

Cvefeed High SeverityAdvisories · Jun 9, 2026

CVE-2026-10523 - Ivanti Sentry Authentication BypassOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News