CVE-2026-10520: ivanti standalone sentry

csirt@kutim:~/threat-intel/cve/CVE-2026-10520

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada ivanti standalone sentry. Skor CVSS 3.1 10.0 (Critical) menurut CNA. Masuk katalog KEV CISA pada 11 Juni 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

Advisory KUTIM-CSIRT

Peringatan Keamanan: Kerentanan Kritis CVE-2026-10520 pada Ivanti Sentry Berpotensi Eksekusi Kode Jarak Jauh 12 Jun 2026

Rincian

Terbit di NVD: 9 Juni 2026
Terakhir diubah: 7 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 10.0 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Ivanti Sentry OS Command Injection Vulnerability
Masuk KEV: 11 Juni 2026
Tenggat CISA: 14 Juni 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ivanti	standalone sentry	Semua versi sebelum 10.5.2
ivanti	standalone sentry	Versi 10.6.0 hingga sebelum 10.6.2
ivanti	standalone sentry	Versi 10.7.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US patch · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520 pemerintah AS
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523 advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.