Ivanti Patches Critical Sentry Flaws That Could Enable Root Code Execution
Summary
Ivanti patched two critical Sentry flaws: CVE-2026-10520 could enable remote code execution as root, while CVE-2026-10523 could allow unauthenticated attackers to create admin accounts. Ivanti reported no known exploitation.
Key points
- CVE-2026-10520 is an OS command injection flaw that could let remote attackers execute code with root privileges.
- CVE-2026-10523 is an authentication bypass that could let unauthenticated remote attackers create rogue administrative accounts and gain full admin access.
- Ivanti released fixes in Sentry versions R10.5.2, R10.6.2, and R10.7.1.
- Ivanti said it was unaware of customer exploitation and advised administrators to upgrade.
Article Details
- Vulnerability Types
- OS command injection
- Authentication bypass
- Severity
- Critical; CVE-2026-10520 is described as maximum severity.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-10520ivanti · Sentryhas released patches for two critical vulnerabilities in its Sentry secure mobile gateway, including CVE-2026-10520, a maximum-severity OS command injection flaw that could let attackers execute code with rootCVE-2026-10523Ivanti · Standalone sentryThe company also fixed CVE-2026-10523, an authentication bypass that could allow unauthenticated remote attackers to create rogue administrative accounts and gain full admin access, while saying there is no evidence of