What is CVE-2026-10520?
CVE-2026-10520 is a critical OS command injection vulnerability in Ivanti Sentry (formerly MobileIron Sentry) allowing unauthenticated remote attackers to achieve root-level remote code execution (RCE), particularly exploitable when the appliance is in an unmanaged state. It is reported to be actively exploited in the wild. Immediate patching with the vendor-supplied update is required to mitigate the risk.
Azərbaycanca: CVE-2026-10520 Ivanti Sentry (əvvəllər MobileIron Sentry) məhsulunda aşkarlanmış kritik bir OS command injection zəifliyidir. Bu zəiflik, uzaqdan autentifikasiya olunmamış hücumçuya root səviyyəsində uzaqdan kod icrası (RCE) etməyə imkan verir, xüsusilə cihaz idarə olunmayan (unmanaged) rejimdə olduqda aktiv şəkildə istismar edilir. Qurğunun təhlükəsizliyini təmin etmək üçün dərhal İvanti tərəfindən buraxılmış təhlükəsizlik yeniləməsini tətbiq etmək tövsiyə olunur.
Related CVEs
link basis: shared threat actors: ShinyHunters, UNC6240; shared vendors: Google Threat Intelligence Group, Mandiant, Oracle
FAQ2
Which product is affected by CVE-2026-10520?
This critical OS command injection vulnerability was discovered in Ivanti Sentry (formerly MobileIron Sentry).
What level of access can an attacker gain by exploiting CVE-2026-10520?
When exploited remotely without authentication, the attacker can achieve root-level remote code execution (RCE).
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.