PT-2026-47806 · Ivanti · Sentry
CVE-2026-10520
·
Published
2026-06-09
·
Updated
2026-07-16
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ivanti Sentry versions prior to 10.5.2
Ivanti Sentry versions prior to 10.6.2
Ivanti Sentry versions prior to 10.7.1
Description
An OS command injection issue exists that allows a remote unauthenticated user to execute arbitrary code with root privileges. The flaw is caused by the failure to neutralize special elements and an authentication bypass via an alternative path. Technical analysis reveals that the
/mics/api/v2/sentry/mics-config/handleMessage endpoint is vulnerable. User input provided in the message variable of a POST request is processed by the handleMessage() function in the ConfigServiceHandler.java class. When the command is set to execute, the input is passed through handleExecute() and eventually to executeNativeCommand(), which executes the string as an operating system command with maximum privileges. Real-world exploitation attempts have been observed globally, with a significant surge in attacks targeting the technology, automotive, banking, finance, insurance, and education sectors. Some reports indicate these attempts were observed on honeypots, while others report thousands of blocked attempts.Recommendations
Update Ivanti Sentry to version 10.5.2 or later.
Update Ivanti Sentry to version 10.6.2 or later.
Update Ivanti Sentry to version 10.7.1 or later.
As a temporary mitigation, restrict access to the
/mics/api/v2/sentry/mics-config/handleMessage endpoint using WAF or IDS rules to block POST requests containing strings such as execute, system, or <commandexec> in the message parameter.
Ensure the management port is not exposed to the internet.Exploit
Fix
RCE
OS Command Injection
Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sentry