Known Exploited Vulnerabilities June 11, 2026 · CISA KEV Catalog

CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability

Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-10520 Ivanti
Related: CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Oct 30, 2026
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Known Exploited Vulnerabilities · Oct 30, 2026
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026