Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-10520

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CVSS 10.0 · CriticalBuzz score 77.3KEV listed1 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 77.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 28.3 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 4.0
Mention score
28.3
16 evidence mentions in the snapshot
Diversity score
20.0
12 sources across 7 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
4.0
1 repos · best confidence 0.80
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
1
within the 30d window
Peak daily
1
highest bucket

Evidence

Source links by recency

Newest mentions first
16 source links · newest first
  • Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation PushDark Reading

    finding success with deploying large language models (LLMs) for vulnerability remediation. Last month, Ivanti disclosed CVE-2026-10520 , a critical maximum-severity flaw in its Sentry mobile gateway product. But the vulnerability, which received a 10 out of 10 CVSS score, wasn't discovered by a security researcher, a third-party vendor, or even Ivanti'

    newswww.darkreading.comJul 20, 2026, 8:26 PM
  • Security Affairs newsletter Round 581 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Washington Pulled the Plug on Anthropic ‘s Fable 5 and Mythos 5 models. The Rest of […]

    newssecurityaffairs.comJun 14, 2026, 1:03 PM
  • Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attackHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: DockSec: Open-source AI-powered Docker security scanner DockSec is an OWASP Incubator Project that combines three container security scanners with a language-model layer for explanation and remediation. Created by Advait Patel, the Python tool runs Trivy, Hadolint, and Docker Scout against a developer’s Dockerfile and image, correlates the findings, returns a 0-100 security score, and proposes line-specific fixes. Treating AI agents … More →

    newswww.helpnetsecurity.comJun 14, 2026, 8:00 AM
  • U.S. CISA adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog and urges patching by June 14Security Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Ivanti Sentry flaw, tracked as CVE-2026-10520 (CVSS score of 10.0), to its Known Exploited Vulnerabilities (KEV) catalog. Ivanti Sentry is a secure gateway appliance that sits between an organization’s internal […]

    newssecurityaffairs.comJun 12, 2026, 6:47 PM
  • Ivanti Sentry Exploitation Attempts Hitting HoneypotsSecurityWeek

    The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

    newswww.securityweek.comJun 12, 2026, 9:44 AM
  • Ivanti Sentry pre-auth RCE (CVE-2026-10520) – CVSS 10.0, public PoC, CISA KEVHacker News

    Linked URL: https://hellorecon.com/blog/cve-2026-10520 | Posted by slvnx | 19 points | 2 comments

    communitynews.ycombinator.comJun 11, 2026, 7:38 PM
  • CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch ReleaseSecurity Affairs

    Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges. “An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote […]

    newssecurityaffairs.comJun 11, 2026, 5:57 PM
  • CVE-2026-10520Horizon3.ai

    CVE-2026-10520 is a critical pre-authenticated OS command injection vulnerability in Ivanti Sentry that allows remote attackers to execute arbitrary commands as root.

    exploithorizon3.aiJun 11, 2026, 3:35 PM
  • Ivanti patches critical Sentry flaws that lead to full device takeoverCSO Online

    IT software provider Ivanti fixed two vulnerabilities in Ivanti Sentry, a secure mobile gateway appliance formerly called MobileIron Sentry. The flaws could allow unauthenticated remote attackers to gain complete control of deployments. One of the vulnerabilities, CVE-2026-10523, credited to researcher Bryan Lam, allows attackers to bypass authentication and create arbitrary administrative accounts on appliances. The […]

    newswww.csoonline.comJun 10, 2026, 8:13 PM
  • Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)Help Net Security

    Ivanti has patched two critical vulnerabilities (CVE-2026-10520 and CVE-2026-10523) in Ivanti Sentry and has urged customers to implement the fix right away. Though the vulnerabilities are not known to be actively exploited, security researchers have already released technical details about the former, which may be used by attackers to craft a working exploit. About Ivanty Sentry and the vulnerabilities Ivanti Sentry is a security gateway that acts as a gatekeeper between mobile devices outside of … More →

    newswww.helpnetsecurity.comJun 10, 2026, 1:02 PM
  • CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti SentryRapid7

    nages, encrypts, and secures traffic between the mobile device and back-end enterprise systems”. The most severe issue, CVE-2026-10520 , is an OS command injection vulnerability with a CVSS score of 10.0 that allows a remote unauthenticated attacker to achieve remote code execution (RCE) with root privileges. The second vulnerability, CVE-2026-10523 ,

    vendorwww.rapid7.comJun 10, 2026, 10:21 AM
  • Critical Vulnerabilities Patched in Fortinet, Ivanti ProductsSecurityWeek

    Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution.

    newswww.securityweek.comJun 10, 2026, 8:50 AM
  • More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)watchTowr Labs

    entry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities. CVE-2026-10520 An OS Command Injection

    exploitlabs.watchtowr.comJun 10, 2026, 12:52 AM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govJun 9, 2026, 4:16 PM
  • https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523github.com

    No excerpt available.

    Exploitgithub.comJun 9, 2026, 4:16 PM
  • https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_UShub.ivanti.com

    No excerpt available.

    Vendor Advisoryhub.ivanti.comJun 9, 2026, 4:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

1 repository references · best confidence 0.80 · max 0 stars

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-17497

    NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. Java…

    CVSS 8.3 · High
    3 mentions
  • CVE-2026-16766

    Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command with…

    CVSS N/A · Unrated
    4 mentions
  • CVE-2026-65711

    sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user…

    CVSS 8.6 · High
    2 mentions
  • CVE-2026-66138

    In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciousl…

    CVSS 7.2 · High
    3 mentions
  • CVE-2026-63732

    9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY n…

    CVSS 9.4 · Critical
    2 mentions
  • CVE-2026-16763

    A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration…

    CVSS 1.9 · Low
    6 mentions