The research describes two critical vulnerabilities in Ivanti Sentry: [CVE-2026-10520](https://t.me/c/3422352556/2/1118) and [CVE-2026-10523](https://dbugs.ptsecurity.com/vulnerability/CVE-2026-10523). The first is an OS command injection vulnerability (CWE-78): improper input handling in an API allows arbitrary commands to be executed at the operating system level without authentication. The second is an authentication bypass vulnerability (CWE-288), which allows a remote attacker to bypass authentication mechanisms and create arbitrary administrative accounts with full system access.

The combination of these vulnerabilities enables a full pre-auth compromise chain: an attacker can first bypass authentication to gain administrative access, and then leverage command injection to execute code with root privileges. This can lead to complete control over the gateway, compromise of credentials and session tokens, and also opens the path for further lateral movement within the infrastructure.

📎 Article: https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

Two critical Ivanti Sentry vulnerabilities enable unauthenticated OS command injection and authentication bypass. Combined, they allow full pre-auth compromise, root access, credential theft, and lateral movement within infrastructure.

Analysis of the vulnerability chain CVE-2026-10520 and CVE-2026-10523 in Ivanti Sentry