# CVE-2026-10520: Ivanti Sentry - RCE

> Live exploitation tracking for CVE-2026-10520 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-10520

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Ivanti Sentry
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** enterprise_software

## Description

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

## CrowdSec analysis

[CVE-2026-10520](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-10520) is a critical OS command injection vulnerability in Ivanti Sentry prior to versions R10.5.2, R10.6.2, and R10.7.1, allowing remote unauthenticated attackers to execute arbitrary commands as root. This flaw could be exploited to gain full control over affected systems, leading to data theft, service disruption, or further compromise of the network environment.

CrowdSec has been tracking this vulnerability and its exploits since 10th of June 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-10520 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec network telemetry also shows that exploitation of CVE-2026-10520 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/mics/api/v2/sentry/mics-config/handleMessage` endpoint by sending specially crafted POST requests containing OS command payloads in the `message` parameter to achieve remote code execution on vulnerable Ivanti Sentry systems.

## Timeline

- 2026-06-09: CVE Published. CVE-2026-10520 is published to NVD.
- 2026-06-10: Rule Released. CrowdSec releases a rule to detect CVE-2026-10520 exploitation attempts against the CrowdSec Network.
- 2026-06-10: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-10520 for the first time.
- 2026-06-11: CISA KEV. CVE-2026-10520 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-06-14: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10520.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-10520) follows observed exploitation activity for CVE-2026-10520. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.