CVE-2026-10520: An OS Command Injection vulnerability in Ivanti Sentry before the R10

Synopsis

An OS command injection vulnerability in Ivanti Sentry (versions before R10.5.2, R10.6.2, and R10.7.1) allows a remote, unauthenticated attacker to inject arbitrary operating system commands through a network-exposed interface. No credentials or user interaction are required to reach the vulnerable code path. Successful exploitation gives the attacker root-level remote code execution on the host, enabling full system compromise including data disclosure, modification, and service disruption. Patched-image rebuilds at versions R10.5.2, R10.6.2, and R10.7.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ivanti Sentry service over the network; the vulnerable interface is exposed remotely with no requirement for LAN or physical proximity.

• AuthenticationNot required

  No credentials of any privilege level are needed; the injection is reachable by any unauthenticated remote user.

• Victim interactionNot required

  No user action or social engineering is required; the attacker triggers the vulnerability entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other variable environmental conditions to succeed.

Blast Radius

• The attacker gains root-level remote code execution on the Sentry host, with full control over all processes and files.
• All data passing through or stored on the Sentry appliance (including mobile device management traffic, credentials, and session tokens) is readable by the attacker.
• The attacker can modify or delete any file on the host, tamper with Sentry configuration, or pivot to systems that trust the Sentry appliance.
• The attacker can crash or permanently disable the Sentry service, cutting off mobile device access to enterprise resources.