2026-008: Critical vulnerabilities in Ivanti Sentry

2026-008: Critical vulnerabilities in Ivanti Sentry ↗ source

June 10, 2026 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2026-008/

Summary

An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device. The vulnerability CVE-2026-10520, with a CVSS score of 10, is an OS Command Injection vulnerability in Ivanti Sentry which allows a remote unauthenticated user to achieve root-level The vulnerability CVE-2026-10523, with a CVSS score of 9.9, is an Authentication Bypass vulnerability in Ivanti Sentry which allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access.

News Coverage

Date	Source	Article
2026-07-04	FortiGuard Labs Threat Signal	Ivanti Sentry Pre-Authentication RCE CVE-2026-10520

Articles from the monitored vendor research blogs and security news feeds that reference a CVE cited in this publication, or name the campaign it covers. Coverage begins when feed monitoring started; earlier articles are not indexed.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2026-10520	10.0 Critical	Ivanti Sentry Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to…
CVE-2026-10523	9.9 Critical	ivanti Sentry An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated at…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Ivanti 35 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.