CVE-2026-10520: Ivanti Sentry — Critical Remote Takeover Risk (June 2026)

CVE-2026-10520 — Ivanti Sentry

CVE-2026-10520 is a critical OS command injection vulnerability in Ivanti Sentry, currently under active exploitation. Attackers are leveraging this flaw to gain remote code execution and backdoor exposed Ivanti Sentry admin portals. CISA has classified the risk as maximum severity and requires federal agencies to patch all affected systems within three days.

Attack Vector

Attackers exploit CVE-2026-10520 by sending crafted requests to vulnerable Ivanti Sentry admin portals exposed to the internet. Successful exploitation enables arbitrary OS command execution, allowing adversaries to implant persistent backdoors. This attack requires only network access to the admin interface—no authentication bypass is needed if the portal is internet-facing. The vulnerability supports automated, large-scale exploitation, increasing the risk of widespread compromise.

Who Is at Risk

All organizations running Ivanti Sentry with admin portals accessible from the internet are at immediate risk, especially those unpatched against CVE-2026-10520. U.S. Federal Civilian Executive Branch agencies are confirmed targets, with multiple compromised gateways reported. Any entity exposing Ivanti Sentry to external networks should assume potential compromise if unpatched.

Patch & Mitigate

• Patch: Apply the official Ivanti Sentry security update addressing CVE-2026-10520 immediately. CISA mandates federal agencies complete patching within three days of notification.
• Workaround: If immediate patching is not possible, restrict admin portal access to trusted internal networks and block external access at the firewall.
• Detect: Review logs for unusual admin portal access, unexpected outbound connections, and evidence of new or modified files or processes. Monitor for indicators of backdoor installation and unauthorized command execution.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed admin portals to gain entry.
• TA0005 — Defense Evasion: Backdoors are deployed to maintain persistence and evade detection.

Source: https://www.bleepingcomputer.com/news/security/cisa-gives-feds-3-days-to-patch-ivanti-flaw-exploited-in-attacks/