CVE-2026-10520

Name of the Vulnerable Software and Affected Versions Ivanti Sentry versions prior to R10.5.2 Ivanti Sentry versions prior to R10.6.2 Ivanti Sentry versions prior to R10.7.1

Description An OS command injection flaw exists in Ivanti Sentry, a security appliance that protects traffic between internal corporate systems and remote mobile devices. The issue stems from the failure to neutralize special elements in user input, allowing a remote unauthenticated user to achieve root-level remote code execution. Real-world exploitation has been observed, with reports indicating that many internet-facing gateways have been compromised and backdoors installed.

Technical details include:

The message variable is processed by handleMessage() and split into tokens. When the command is set to 'execute', the data is passed through handleExecute() to executeNativeCommand(), which eventually executes the string as an operating system command with root privileges.

Recommendations Update to version R10.5.2. Update to version R10.6.2. Update to version R10.7.1. Restrict or block POST requests to the '/mics/api/v2/sentry/mics-config/handleMessage' endpoint using WAF or IDS rules, specifically targeting the message parameter for strings such as 'execute', 'system', or ''.