CVE-2026-10520

Ivanti Sentry before the R10.5.2, R10.6.2, and R10.7.1 versions contains an OS command injection flaw reachable without authentication. User-controlled input from a remote request is incorporated into a system command without proper sanitization, so a crafted request lets an unauthenticated attacker execute arbitrary commands on the appliance. The commands run at root level, meaning a single request converts network reachability into full control of the device.

Sentry brokers and secures mobile device traffic to backend resources, sitting at the network edge in a trusted gatekeeper role, which is precisely the class of appliance that repeated Ivanti disclosures have shown to be a favored target for intrusion and persistence. A pre-auth, root-level CVSS 10 command injection on such a device gives an attacker a durable foothold inside the perimeter. Upgrade to the fixed R10.5.2, R10.6.2, or R10.7.1 release without delay, ensure the administrative and management interfaces are not exposed to untrusted networks, and given Ivanti appliances' history of active exploitation, inspect affected devices for command execution artifacts and signs of persistence rather than trusting the patch alone.