CVE-2026-10520

Exploited in the wild. In CISA KEV since 2026‑06‑11. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2026-06-11, due 2026-06-14
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-09Updated 2026-07-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Update Ivanti Sentry / ivanti standalone sentry to a version at or after R10.5.2, R10.6.2, or R10.7.1 (whichever applies to your deployment).
If you can’t patch immediately, temporarily restrict network access to the Ivanti Sentry endpoints so they are not reachable by the public internet (or from untrusted networks).
Confirm whether your environment is exposed and initiate log/alert checks with your IT person using the vendor’s guidance for suspicious activity.

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

In plain language

Written by AI from the record

CVE-2026-10520 is a critical, actively exploited flaw in Ivanti Sentry (including ivanti standalone sentry) that can let an attacker remotely run commands as root without logging in—small businesses using these products should act immediately.

What is it

This vulnerability lets an attacker “trick” the Ivanti Sentry system into running operating-system commands on your server. A simple analogy is someone finding a way to write commands into the instructions your software follows, so the software executes them with the highest privileges. Because it’s remote and does not require login, the attacker doesn’t need access inside your company to do this.

Who is affected

This matters to you if you use or manage Ivanti Sentry or ivanti standalone sentry versions before R10.5.2, R10.6.2, and R10.7.1. It also matters if your device is reachable from the internet (or from a network segment attackers can reach), because the flaw can be triggered by a remote, unauthenticated user. The press notes active real-world exploitation (itw), and the named actor associated is UNC6240 (ShinyHunters).

How urgent is it

This is RED urgent: the issue is already being exploited in the wild (itw) and is listed in CISA KEV (Known Exploited Vulnerabilities), which means attackers are actively using it. With a high EPSS estimate (47.9% chance of exploitation in the next 30 days) and root-level remote code execution potential, you should treat this as an emergency patching and containment situation, not a routine update.

What to do — in detail

Identify exposure and version: Determine whether you run Ivanti Sentry or ivanti standalone sentry, and confirm the exact installed version. Verify which of the fixed-version thresholds applies: R10.5.2, R10.6.2, R10.7.1.
Patch as the top priority: Upgrade to a fixed release that is not in the vulnerable range. If you have multiple nodes or environments, prioritize anything Internet-facing and anything accessible from less-trusted networks.
Contain while patching: If updates will take time, reduce risk by blocking inbound access from the internet and any untrusted networks to the Ivanti Sentry services tied to management/web access.
Check for signs of compromise: Since this can lead to root-level remote code execution, review relevant system and application logs for unusual command execution, unexpected outbound connections, new scheduled tasks/cron jobs (if applicable), new users, or unexpected configuration changes.
Monitor after update: After patching, keep monitoring for continued malicious attempts (failed exploit attempts and abnormal access patterns), and verify the service still functions normally.
Coordinate with your vendor/IT support: Ask your IT support for an implementation plan matching your deployment style (Sentry vs standalone) and for any vendor-provided detection or hardening steps specific to this CVE.

Technical context

Severity: described as root-level remote code execution via OS command injection. A remote, unauthenticated attacker can inject commands that the affected Ivanti Sentry software executes on the underlying operating system.
Exploitation status: press indicates itw (in the wild), and CISA KEV lists this issue as known exploited. Public exploit availability is reported as no, but exploitation can still occur using attacker tooling without a public drop.
Related actor: the press names UNC6240 (ShinyHunters) in connection with sustained attention.
EPSS/KEV meaning here: EPSS 47.9% is an estimate of the likelihood of exploitation in the next 30 days; CISA KEV indicates the vulnerability is actively exploited and prioritized for action by organizations.
Affected components/products: Ivanti Sentry and ivanti standalone sentry before R10.5.2, R10.6.2, and R10.7.1.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-06-11.

US federal agencies must remediate by 2026-06-14.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

16 events over 57 days, from the signal feeds we watch.

2026-08-05Analysis publishedThe guardian is the gateway: 2026's exploited-bug list is a map of the security products we trusted
2026-07-23Patch availablerecord updated
2026-07-17Analysis publishedPatch tonight: CVE-2026-10520 is a CVSS 10 pre-auth root shell on Ivanti Sentry
2026-06-29EPSS band changehigh → critical
2026-06-28EPSS band changehigh → critical
2026-06-27EPSS band changehigh → critical

Affected products

Ivanticommercial · USaka avalanche, ivanti connect secure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable