Critical Vulnerabilities in Ivanti Sentry - CVE-2026-10520, CVE-2026-10523

THE THREAT

On June 9th, 2026, Ivanti disclosed two critical vulnerabilities affecting its Sentry secure mobile gateway solution. These vulnerabilities are identified as CVE-2026-10520 (CVSS: 10.0) and CVE-2026-10523 (CVSS: 9.9), both of which could allow remote, unauthenticated attackers to fully compromise affected systems.

While Ivanti reports no evidence of active exploitation at this time, watchTowr Labs has published a detailed technical write-up and a publicly available detection script, substantially lowering the bar for threat actors to weaponize these flaws.

Ivanti has released patched versions 10.5.2, 10.6.2, and 10.7.1 to remediate these vulnerabilities. Customers are strongly advised to upgrade their Sentry appliances immediately to these fixed versions to mitigate potential risk.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire's Threat Response Unit (TRU) has developed detections within MDR for Network and is evaluating detection opportunities within MDR for Log

What you should do about it

• After performing a business impact review, apply the relevant security patches
• If immediate patching is not possible, the following mitigation steps should be performed:
  • Review all admin accounts on affected appliances for any created unexpectedly or without authorisation
  • Review logs for exploitation indicators
    • Check access logs for POST requests to the handleMessage endpoint from external IP addresses
  • Run the watchTowr detection script against your environment to confirm vulnerability status

Additional information

The first vulnerability, CVE-2026-10520, is an operating system command injection flaw. This vulnerability impacts Ivanti Sentry versions prior to 10.5.2, 10.6.2, and 10.7.1. It allows a remote unauthenticated user to execute arbitrary commands with root-level privileges on the underlying system.

The second vulnerability, CVE-2026-10523, is an authentication bypass issue affecting the same versions. A remote unauthenticated attacker can exploit this flaw to bypass authentication mechanisms, create arbitrary administrative accounts, and gain unrestricted administrative access to the system.

watchTowr Labs published an in-depth technical analysis of CVE-2026-10520, significantly improving the understanding of the vulnerability. Along with their report, watchTowr Labs published a detection artifact generator on GitHub, which can be used by organizations to determine if their Ivanti Sentry device is vulnerable. 

According to watchTowr and supporting technical analysis:

• The vulnerability resides in the Sentry web application, specifically within backend components responsible for processing configuration messages
• An unauthenticated API endpoint (/mics/api/v2/sentry/mics-config/handleMessage) accepts attacker-controlled input
• This input is parsed as a legitimate internal configuration command without proper validation or sanitization
• The backend handler executes these commands with elevated privileges, effectively allowing arbitrary OS command execution as root

watchTowr Labs confirmed exploitation by sending the following unauthenticated POST request to a vulnerable instance:

message=execute system /configuration/system/commandexec
<commandexec><index>1</index><reqandres>uname -a</reqandres></commandexec>

The appliance returned the full kernel version string, confirming root-level OS command execution with no prior authentication. 

Ivanti Sentry is an in-line gateway that manages, encrypts, and secures traffic between mobile devices and back-end enterprise systems. Because Ivanti Sentry operates as a gateway appliance at the network edge, compromise provides attackers with direct access to internal enterprise systems and traffic flows. Ivanti has a well-documented history of critical vulnerabilities in its edge appliances, several of which have been exploited in the wild by state actors and ransomware actors. This track record means that patching for Ivanti products should be treated as a high operational priority.

References:
[1] https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
[2] https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
[3] https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523