Ivanti Sentry CVE-2026-10520 Pre-Auth RCE Advisory, CVE-2026-10523 Auth Bypass, PoC and Mitigation

Vulnerability Overview CVE-2026-10520: Ivanti Sentry Unauthorized OS Command Injection Ivanti Sentry (formerly MobileIron Sentry) contains a pre-authentication operating system command injection vulnerability that allows remote attackers to execute root-level code. The vulnerability has a CVSS score of 10.0, is being actively exploited in the wild, has been added to the CISA KEV list, and carries a 3-day patch deadline. WatchTowr Labs has provided a publicly available Proof of Concept (PoC). Scope of Impact Affected Versions: Ivanti Sentry versions prior to RI0.5.2, RI0.6.2, and RI0.7.1 (all RI0.5.x, RI0.6.x, and RI0.7.x series) Fixed Versions: RI0.5.2, RI0.6.2, RI0.7.1 Exploitation Status: Confirmed exploitation in the wild; added to the CISA KEV list on June 11, 2026, with a patch deadline of June 14. PoC: Public PoC available from WatchTowr Labs Remediation 1. Patch Immediately: Upgrade Ivanti Sentry to RI0.5.2, RI0.6.2, or RI0.7.1. The patch blocks unauthorized access by hardcoding command input and adding Apache rewrite rules, returning a 302 redirect. 2. Restrict Network Access: If patching takes time, use firewall rules to restrict access to the Sentry HTTPS port, allowing traffic only from trusted management networks. Block all external access to the path. 3. Use mTLS Where Possible: Ivanti states that deployments using mTLS with EPPM or restricted HTTPS via Neurons for MDM reduce exposure because the vulnerable interface is not externally accessible. 4. Check for Indicators of Compromise (IoCs): Review Sentry logs for POST requests to . Look for unexpected system processes, new user accounts, or modified configuration files—the RCE runs as the root user. 5. Address CVE-2026-10523 in Parallel: This authentication bypass (CVSS 9.8) allows attackers to create arbitrary admin accounts and gain full administrative access to Sentry devices. Both vulnerabilities affect the same versions and require the same patch. 6. Audit Your EPPM Infrastructure: If Sentry is compromised, attackers may have accessed EPPM, Exchange, or other internal services. Review EPPM logs, Exchange mail flow rules, and Active Directory to detect lateral movement indicators. Related Vulnerabilities CVE-2026-10523 (Authentication Bypass) CVE-2026-10523 (CVSS 9.8), disclosed in the same advisory, is a separate authentication bypass vulnerability that allows unauthenticated remote attackers to create arbitrary administrator accounts and gain full administrative access to Sentry devices. Both vulnerabilities affect the same versions and require the same patch. The WatchTowr PoC covers both CVEs. Investigation Workflow 1. Port Scanning: Locate Sentry Devices - Ivanti Sentry listens on port 8443 (HTTPS) by default. Scan DMZ and perimeter subnets to identify this port. - Check for: - 8443 - Sentry HTTPS (Primary - MICS Web Application) - 443 - Possible usage via reverse proxy - 9999 - Sentry Management Console (in some deployments) - Any host with port 8443 open in the DMZ segment warrants further investigation. 2. TLS Inspection: Identify Ivanti Certificates - Extract TLS certificates from port 8443. Ivanti Sentry devices typically use self-signed certificates with the following characteristics: - Subject or Issuer fields contain “Ivanti”, “MobileIron”, or “Sentry” - Originally issued to MobileIron (pre-acquisition name) - Self-signed certificates on non-standard HTTPS ports 3. HTTP Headers: Fingerprint the MICS Application - The vulnerable application runs on a Tomcat server at the path. Probe for: - - Sentry login page (returns a Spring Boot application response) - Patched instances return a 302 redirect to the login page, while unpatched instances return 200 - Tomcat and Spring Boot indicators in response headers - Ivanti or MobileIron branding in the login page and error messages 4. DNS: Discover Sentry Infrastructure - Query internal DNS for common Sentry naming patterns: , , , , , . Sentry devices are often deployed alongside EPPM infrastructure, so look for related hosts such as or —they may indicate the same deployment. 5. CVE Lookup: Confirm Advisory Details - Use RECON’s CVE lookup feature to retrieve the full NVD entry for CVE-2026-10520. CISA added it to the KEV list after the June 14 deadline for federal agencies and organizations, adhering to the 3-day patch requirement of BOD 25-04. Also check CVE-2026-10523—both vulnerabilities affect the same versions and require the same patch. Cross-Referencing with External Data SHODAN: Search for “MobileIron” on port 8443 or “Ivanti” on port 8443 to find internet-exposed instances. CVE Lookup: Check the NVD for CVE-2026-10520 and CVE-2026-10523 for updated scores. CISA KEV: Both CVEs have been listed—the patch deadline is June 14, 2026. Ivanti Advisory: Security Advisory - Ivanti Sentry Sources Ivanti Security Advisory CVE-2026-10520 and CVE-2026-10523 NVD: CVE-2026-10520 NVD: CVE-2026-10523 WatchTowr Labs: Ivanti Sentry Pre-Auth RCE Analysis CISA Known Exploited Vulnerabilities Catalo

Goal Reached Thanks to every supporter — we hit 100%!

Ivanti Sentry CVE-2026-10520 Pre-Auth RCE Advisory, CVE-2026-10523 Auth Bypass, PoC and Mitigation

More from this source