EUVD-2026-35440
GHSA-v2vc-rgvq-3pwf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Articles & Coverage 4
AnalysisAI
Remote code execution in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows unauthenticated remote attackers to achieve root-level command execution via OS command injection. With a maximum CVSS score of 10.0 and a network-accessible, no-interaction attack vector, this represents a critical exposure for any internet-facing Sentry appliance, though no public exploit has been identified at time of analysis.
Technical ContextAI
Ivanti Sentry (formerly MobileIron Sentry) is a gateway appliance that brokers ActiveSync, AppTunnel, and Kerberos Constrained Delegation traffic between mobile devices and back-end enterprise services such as Exchange and SharePoint. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied input flows into a shell or system call without adequate sanitization. The Scope:Changed (S:C) component of the CVSS vector indicates the injection breaks out of the originally exploited security context - consistent with web-tier input being passed to an OS-level process that runs as root on the underlying Linux appliance. The CPE wildcard (cpe:2.3:a:ivanti:sentry:*) confirms all Sentry versions prior to the fixed releases are in scope.
RemediationAI
Vendor-released patches are available: upgrade to Ivanti Sentry R10.5.2, R10.6.2, or R10.7.1 (or later) on the corresponding maintenance branch per the advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US. Until patching is complete, restrict network access to the Sentry administrative and system interfaces (typically TCP 8443 and 9090) to a management VLAN or jump-host source IPs only - note that the device-facing ActiveSync/AppTunnel ports must remain reachable for mobile clients to function, so blanket port blocks will break the service. Consider placing the appliance behind a WAF or reverse proxy that can inspect and constrain administrative URIs, and monitor system logs for unexpected shell process creation or outbound connections originating from the appliance, since post-exploitation root activity will be visible at the OS level. If patching cannot occur immediately, take internet-exposed Sentry nodes offline rather than relying on detection alone.
Authentication bypass in Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to c
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
Sentry is an error tracking and performance monitoring platform. Rated high severity (CVSS 8.1), this vulnerability is r
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauth
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Rated medium severity (CVSS 5.3
SAML authentication bypass in Sentry 21.12.0 through 26.1.0.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute
An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1
Denial of service in Sentry's self-hosted/SaaS event ingestion pipeline (versions 24.4.0 through 26.5.1) lets remote act
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today