CISA Flags Ivanti Sentry Flaw as Exploited, but Ivanti Cites Honeypot Attempts
Summary
CISA added CVE-2026-10520 to its KEV catalog after attempted exploitation was observed on honeypots, while Ivanti says it has no evidence of in-the-wild exploitation. The flaw allows unauthenticated remote root command execution; patches are available.
Key points
- CVE-2026-10520 is an OS command injection flaw that could allow unauthenticated remote code execution with root privileges.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and urged federal agencies to address it within three days.
- Ivanti says it has no evidence of in-the-wild exploitation and says the KEV listing was based on attempted exploitation of honeypots.
- Exploitation requires access to the management port, 8443; Ivanti says management interfaces should not be exposed to the internet.
- Ivanti Sentry versions 10.5.2, 10.6.2, and 10.7.1 include fixes.
- Ivanti says mTLS protects vulnerable APIs on EPMM-managed appliances; for Neurons for MDM-managed appliances, it recommends restricting internet access to the vulnerable API.
Article Details
- Vulnerability Types
- OS command injection
- Severity
- CVSS 10/10
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Do not expose management interfaces to the internet.
- For Neurons for MDM-managed Sentry appliances, restrict internet access to the vulnerable API.
MITRE ATT&CK
CVE
Vendors
Products
Ivanti Endpoint Manager Mobile (EPMM)The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors,” CISA notes.Ivanti SentryThe US Cybersecurity and Infrastructure Security Agency (CISA) flagged a recently patched Ivanti Sentry vulnerability as exploited, but Ivanti says the activity was observed only on honeypots.Neurons for MDMThe use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors,” CISA notes.