Patch tonight: CVE-2026-10520 is a CVSS 10 pre-auth root shell on Ivanti Sentry
A max-severity command injection in Ivanti Standalone Sentry is being exploited in the wild. No workaround, one fix path — here is the status and what to do.
A max-severity pre-auth root shell on Ivanti Sentry — already exploited
In early June 2026, Ivanti disclosed two critical flaws in Standalone Sentry and shipped fixes the same day. The headline, CVE-2026-10520, goes to the top of the triage pile on its numbers alone: a CVSS 10.0, unauthenticated, remote command injection that yields root on the appliance — and CISA has already confirmed it is being exploited.
Scores as of 2026-07-17live record →
What the flaw actually is
CVE-2026-10520 is an OS command injection (CWE-78) in Ivanti Standalone Sentry. Three parts of the CVSS vector matter operationally: PR:N (no authentication required), AV:N (reachable over the network), and S:C — a scope change, meaning the injected command escapes the vulnerable component and runs with the privileges of the underlying host. That combination is why the score is a flat 10.0 and why the advisory describes the result as root-level remote code execution. MITRE maps it to ATT&CK T1059 — Command and Scripting Interpreter (Execution).
| Field | CVE-2026-10520 (the RCE) | CVE-2026-10523 (the companion) |
|---|---|---|
| Type | OS command injection | Authentication bypass |
| CWE | CWE-78 | CWE-288 |
| CVSS | 10.0 (Critical) | 9.9 (Critical) |
| EPSS | 0.99 (99.93rd pct) | 0.47 (98.7th pct) |
| Authentication | None required (pre-auth) | None required (pre-auth) |
| Impact | Root-level RCE | Create admin accounts / full admin |
| Fixed in | R10.5.2 / R10.6.2 / R10.7.1 | R10.5.2 / R10.6.2 / R10.7.1 |
Where this ranks right now
EPSS is not severity, it is likelihood — and CVE-2026-10520 sits at the top of the recent batch. Among the critical, network-accessible CVEs CISA added to its KEV catalog in June 2026, the Ivanti Sentry RCE has the highest modeled exploitation probability of the group:
| Label | Value |
|---|---|
| Ivanti Sentry (CVE-2026-10520) | 99 |
| PeopleSoft (CVE-2026-35273) | 92 |
| Splunk (CVE-2026-20253) | 88 |
| Check Point VPN (CVE-2026-50751) | 70 |
| ColdFusion (CVE-2026-48282) | 29 |
Who is exposed
Affected: Ivanti Standalone Sentry below the fixed releases — per NVD, Standalone Sentry prior to 10.5.2, with the vendor's branch-specific fixes being R10.5.2, R10.6.2, and R10.7.1. The risk concentrates on any Sentry whose management interface is reachable from the internet or a wide internal zone. DR/standby units and forgotten branch boxes are the usual blind spots — inventory those too.
From disclosure to exploitation
- Ivanti discloses both flaws and ships fixesCVE-2026-10520 (CVSS 10.0) and CVE-2026-10523 published; R10.5.2 / R10.6.2 / R10.7.1 released the same day.
- Confirmed in-the-wild exploitationCISA lists CVE-2026-10520 in its Known Exploited Vulnerabilities catalog.
- Technical write-up and proof-of-concept publishedResearch firm watchtowr releases a technical analysis and a PoC for the pre-auth RCE. No Metasploit or Nuclei module was on file as of writing.
The attack path in one diagram
CVE-2026-10520 attack chain
- Internet attacker
- Sentry management interface (no auth required)
- Running a version below the fixed release?
- OS command injection (CWE-78)
- Root-level RCE on the appliance (CVSS 10.0, scope C)
- Persistence · credential theft · lateral pivot
- Alt path: CVE-2026-10523 auth bypass → mint admin account
- Patched release — not affected
Check and fix
- Inventory every Ivanti Standalone Sentry instance — including DR/standby and branch units — and record each release.
- Confirm the running release. Anything below R10.5.2 (or R10.6.2 / R10.7.1 for its branch) is affected.
- Upgrade to the fixed release for your branch: R10.5.2, R10.6.2, or R10.7.1. There is no vendor workaround.
- If a vulnerable Sentry was internet-facing, treat it as potentially compromised: review logs and the admin-account list, hunt for unexpected outbound connections, and rotate credentials.
- Verify the patch against the Ivanti customer hub for your specific deployment before considering the item closed.
What to trust in this write-up
The bottom line
If you run Ivanti Standalone Sentry below R10.5.2 / R10.6.2 / R10.7.1, this is a patch-tonight problem. Pre-auth root on a network-edge appliance that CISA already sees exploited is the top of the pile — and unlike most criticals, there is no mitigation to buy time with. Find the boxes, upgrade, and assume exposure if any were reachable.
What is CVE-2026-10520?
Is there a workaround?
Is it being exploited?
Which versions are fixed?
Is this the same as the Ivanti Connect Secure flaws from 2023–2024?
Risk data as of 2026-07-17