Ivanti Sentry CVE-2026-10520

No special conditions - remote unauthenticated exploitation against default configurations of Ivanti Sentry where the attacker has network reachability to the vulnerable service endpoint (CVSS AV:N/AC:L/PR:N/UI:N). The only limiting factor is network-layer access to the vulnerable interface: appliances whose administrative/system ports are firewalled to a management network are not reachable, while any Sentry node directly exposed to the internet or to a broad internal segment is exploitable in a single request with no user interaction, no credentials, and no non-default settings required. The advisory does not indicate the vulnerable endpoint is gated behind an optional feature, so all supported versions prior to R10.5.2/R10.6.2/R10.7.1 should be treated as exploitable.

All available signals point to this being a top-priority issue: CVSS 10.0 with AV:N/AC:L/PR:N/UI:N means trivially reachable over the network with no authentication or user interaction, and C:H/I:H/A:H with S:C means full host compromise crossing trust boundaries. Sentry appliances are by design exposed to mobile devices on untrusted networks, amplifying the network-reachability concern. That said, EPSS data was not provided and the CVE is not currently listed in CISA KEV, so there is no public evidence of mass exploitation yet - though Ivanti gateway products (Sentry, Connect Secure, EPMM) have a strong recent track record of being exploited shortly after disclosure (e.g., CVE-2023-38035 in the same product line was actively exploited). Treat this as a near-certain exploitation candidate rather than a theoretical issue, despite the absence of confirmed in-the-wild activity at this moment.

An attacker scans for internet-exposed Ivanti Sentry administrative or system interfaces, then sends a single crafted HTTP request containing shell metacharacters in a parameter that is passed unsanitized to an OS command. The injected command executes as root on the appliance, giving the attacker a foothold from which to harvest configuration secrets (Kerberos keytabs, Exchange service credentials, certificates), pivot into the internal Exchange/AD environment, and deploy a persistent webshell or reverse tunnel.