This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti fixes 3 vulnerabilities, 1 of them actively exploited

Ivanti fixes 3 vulnerabilities in Ivanti Sentry [1] and Ivanti Endpoint Manager Mobile [2]. Based on evidence of active exploitation, the CVE-2026-10520 vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog [3]. Products and their fixed versions: Ivanti Sentry - 10.5.2, 10.6.2, 10.7.1 [1] Ivanti Endpoint Manager Mobile - 12.9.0.1, 12.8.0.3, 12.7.0.2 [2]

Ivanti Sentry - RCE (CVE-2026-10520)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute arbitrary code with root privileges due to an OS Command Injection vulnerability in Ivanti Sentry [1].

The vulnerability is present in product:

  • Ivanti Sentry; <=10.5.1; <=10.6.1; <=10.7.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-10520 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 6. 2026.

Ivanti Sentry - authentication bypass (CVE-2026-10523)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can create arbitrary administrator accounts in Ivanti Sentry and gain full administrative access [1].

The vulnerability is present in product:

  • Ivanti Sentry; <=10.5.1; <=10.6.1; <=10.7.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 9. 6. 2026.

Ivanti Endpoint Manager Mobile - arbitrary command execution (CVE-2026-10727)
CVSS 7.2 (High)

An authenticated remote attacker can execute arbitrary commands with root privileges due to an OS Command Injection vulnerability in Ivanti EPMM [2].

The vulnerability is present in product:

  • Ivanti Endpoint Manager Mobile; <=12.9.0; <=12.8.0.2; <=12.7.0.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-10727 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 9. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 6. 2026.

CESNET, z.s.p.o. Logo