Ivanti Sentry - RCE (CVE-2026-10520)

CVE-2026-10520 is a critical OS command injection vulnerability in Ivanti Sentry prior to versions R10.5.2, R10.6.2, and R10.7.1, allowing remote unauthenticated attackers to execute arbitrary commands as root. This flaw could be exploited to gain full control over affected systems, leading to data theft, service disruption, or further compromise of the network environment.

CrowdSec has been tracking this vulnerability and its exploits since 10th of June 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-10520 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec network telemetry also shows that exploitation of CVE-2026-10520 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /mics/api/v2/sentry/mics-config/handleMessage endpoint by sending specially crafted POST requests containing OS command payloads in the message parameter to achieve remote code execution on vulnerable Ivanti Sentry systems.