Skip to content

Ivanti Sentry CVE-2026-10520 exploitation

Summary

CVE-2026-10520 is a critical Ivanti Sentry OS command-injection vulnerability that can allow remote unauthenticated root-level code execution on affected appliances. Ivanti fixed the issue in Sentry R10.5.2, R10.6.2, and R10.7.1; CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-11.

The durable defender lesson is edge-appliance exposure control: CISA says exploitation is possible when a Sentry appliance is in an unmanaged state and its endpoints are externally reachable, while mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes the interfaces inaccessible to external actors.

Tags

Why this matters

  • Ivanti Sentry is a mobile-access gateway that often sits between mobile fleets and internal enterprise resources such as Microsoft Exchange / ActiveSync and application back ends.
  • The command-injection path is network reachable, low complexity, requires no user interaction, and has CVSS v3.1 10.0 severity.
  • A companion Sentry flaw, CVE-2026-10523, is an authentication-bypass issue that Ivanti describes as allowing arbitrary administrative-account creation and full administrative access before the same fixed releases.
  • CISA's KEV due date for covered federal agencies is 2026-06-14, a three-day window that reflects urgent edge-appliance risk.
  • watchTowr published technical analysis and a detection artifact generator after diffing vulnerable and fixed Sentry builds, so defenders should expect broad reproducibility even where public actor attribution is not yet available.

Operational characteristics

  • Affected product: Ivanti Sentry, formerly MobileIron Sentry.
  • Fixed versions: R10.5.2, R10.6.2, and R10.7.1 are listed as unaffected for both CVE-2026-10520 and CVE-2026-10523 in the CVE records.
  • Exploit primitive: CVE-2026-10520 is OS command injection that can grant root-level remote code execution.
  • Companion issue: CVE-2026-10523 is an authentication-bypass vulnerability that can allow creation of arbitrary administrative accounts and full administrative access.
  • Exposure condition called out by CISA: successful CVE-2026-10520 exploitation is possible when Sentry is unmanaged and endpoints are externally reachable; mTLS with EPMM or restricted HTTPS access through Neurons for MDM limits external reachability.
  • Observed exploitation: CISA added CVE-2026-10520 to KEV on 2026-06-11 and lists ransomware use as unknown.
  • watchTowr route analysis: watchTowr's public writeup identifies the Sentry application context as /mics and the analyzed request path as /mics/api/v2/sentry/mics-config/handleMessage, where a user-supplied message value reaches command-processing logic.
  • Public detection artifact: watchTowr's GitHub repository demonstrates a detection artifact generator that sends a command-execution check to /mics/api/v2/sentry/mics-config/handleMessage and reports whether a target appears vulnerable.

Defender heuristics

  • Inventory Ivanti Sentry / MobileIron Sentry appliances, especially systems with internet-reachable /mics paths or management/API endpoints.
  • Upgrade affected appliances to Ivanti's fixed branches: R10.5.2, R10.6.2, or R10.7.1.
  • If immediate upgrade is not possible, apply Ivanti-recommended mitigations and reduce external reachability: enforce mTLS with EPMM, restrict HTTPS access through Neurons for MDM, and block direct internet exposure to Sentry endpoints.
  • Treat exposed unmanaged Sentry appliances as potentially compromised until reviewed. Preserve web, Tomcat/application, authentication, admin-account, system, process, and outbound-connection logs before reimaging or rebuilding.
  • Hunt for requests to /mics/api/v2/sentry/mics-config/handleMessage, unusual message parameters, unexpected command output in responses, new or modified administrative accounts, and post-exploitation shell activity from Sentry hosts.
  • Review downstream trust: mail, ActiveSync, mobile-device-management, VPN, and application paths reachable through the Sentry gateway may have been used after appliance compromise.
  • Correlate Sentry outbound traffic with new DNS lookups, curl/wget-like downloads, reverse shells, SSH keys, cron/systemd persistence, and internal scans.
  • Because CISA lists ransomware use as unknown rather than absent, avoid assuming a narrow espionage or crimeware profile; prioritize containment, credential rotation, and internal-path review based on observed access.

Sources

  • Ivanti advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
  • CISA KEV feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • CISA KEV catalog page: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • CVE record for CVE-2026-10520: https://cveawg.mitre.org/api/cve/CVE-2026-10520
  • CVE record for CVE-2026-10523: https://cveawg.mitre.org/api/cve/CVE-2026-10523
  • watchTowr technical analysis: https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
  • watchTowr detection artifact generator: https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523