KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-10520
10.0
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityIvanti Sentry OS Command Injection Vulnerability
VendorIvanti
ProductSentry
Date added2026-06-11
Due date2026-06-14
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-78
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions
KEV: Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution.
NVD: An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-26 03:41 UTC
Wall time0.5s
Searches4
Component defaultyes
Sources
https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
https://www.rapid7.com/blog/post/etr-cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry/
https://cveplayground.com/blog/cve-2026-10520-ivanti-sentry-mics-api-unauthenticated-rce/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523
https://www.esentire.com/security-advisories/critical-vulnerabilities-in-ivanti-sentry-cve-2026-10520-cve-2026-10523
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523
https://www.rapid7.com/blog/post/etr-cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry/
https://cveplayground.com/blog/cve-2026-10520-ivanti-sentry-mics-api-unauthenticated-rce/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523
https://www.esentire.com/security-advisories/critical-vulnerabilities-in-ivanti-sentry-cve-2026-10520-cve-2026-10523
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523
Hunting hypothesis agent
Hunt Sentry logs for POST to /mics/api/v2/sentry/mics-config/handleMessage containing <commandexec><reqandres> XML tags, as the watchTowr PoC injects OS commands via this path and returns output in JSON; stock logs may miss POST bodies.
Research details
ComponentConfigServiceController Spring Boot endpoint at /mics/api/v2/sentry/mics-config/handleMessage within mics.war
PreconditionsIvanti Sentry (formerly MobileIron Sentry) versions before R10.5.2, R10.6.2, and R10.7.1 are affected. The MICS API endpoint must be network-accessible on the port running the Tomcat-based Sentry application (typically 8443 for HTTPS management). No authentication is required; the endpoint processes a user-supplied message string as a MICS configuration command. The attacker sends a POST with a message body in the format 'execute system /configuration/system/commandexec <commandexec><index>1</index><reqandres>COMMAND</reqandres></commandexec>' where COMMAND is the OS command to execute. The patched version hardcodes the message input to a benign command and adds Apache regex rules that redirect unauthenticated requests to the login page. CISA KEV notes that exploitation also requires the Sentry appliance to be in an unmanaged state with endpoints externally reachable; mTLS with EPMM or restricted HTTPS access through Neurons for MDM renders the interface inaccessible. agent
DeliveryHTTP POST to /mics/api/v2/sentry/mics-config/handleMessage with Content-Type application/x-www-form-urlencoded and a message body containing: execute system /configuration/system/commandexec <commandexec><index>1</index><reqandres>OS_COMMAND</reqandres></commandexec>. The response returns the command output in JSON: {"status":200,"data":"<result><success>OUTPUT</success></result>"}.
Public PoCyes
PoC URLs
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523
https://github.com/ogenich/CVE-2026-10520
https://github.com/p3Nt3st3r-sTAr/CVE-2026-10520-CVE-2026-10523 Third-party repos; verify before use.
https://github.com/ogenich/CVE-2026-10520
https://github.com/p3Nt3st3r-sTAr/CVE-2026-10520-CVE-2026-10523 Third-party repos; verify before use.
Advisoryhttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523
Exploit notesCVSS 10.0 (Critical). Public PoC available from watchTowr Labs (detection artifact generator with command execution capability) and two additional GitHub repos. The exploit is a single unauthenticated HTTP POST request; the watchTowr tool demonstrates full command execution with output returned in the HTTP response body as XML within JSON. The vulnerable code path parses a user-supplied MICS configuration command string, routes the 'execute' command to handleExecute(), and ultimately invokes executeNativeCommand() via reflection, passing attacker-controlled XPath and value parameters to OS-level command execution. Actively exploited in the wild; Shadowserver confirmed backdoored enterprise mobile gateways within 24 hours of disclosure.
SummaryIvanti Sentry (formerly MobileIron Sentry) versions before R10.5.2, R10.6.2, and R10.7.1 contain a pre-authentication OS command injection vulnerability (CVSS 10.0) in the MICS configuration API endpoint. An unauthenticated remote attacker sends a single HTTP POST to /mics/api/v2/sentry/mics-config/handleMessage with an XML command payload containing the 'execute system' command and attacker-controlled OS commands in the <reqandres> field. The endpoint processes the message through ConfigServiceHandler and ConfigRequestProcessor, ultimately calling executeNativeCommand() via Java reflection, achieving root-level RCE. Command output is returned directly in the HTTP response. Public PoC exploit code is available from watchTowr Labs and two additional repositories. Active exploitation has been observed by Shadowserver and CrowdSec since disclosure.
Tia coverage
First reported2026-06-10
First exploit report2026-06-11
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
chocopoc-malware-targets-security-researchers-via-trojanized-pocivanti-sentry-max-severity-rce-auth-bypass-cve-2026-10520-cvss-1poellm-malware-infects-exposed-ai-servers-in-cryptomining-attack
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.