Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Ivanti Releases Security Advisory for Critical Vulnerabilities in Sentry

If exploited, two critical vulnerabilities could allow for unauthenticated OS command injection or authentication bypass

Threat ID:
CC-4795
Threat Severity:
Medium
Published:
10 June 2026 10:05 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

If exploited, two critical vulnerabilities could allow for unauthenticated OS command injection or authentication bypass

Threat details

Exploitation of CVE-2026-10520 in the wild

Following the release of a proof-of-concept exploit, cyber security researchers are reporting exploitation of vulnerability CVE-2026-10520 in the wild.

The NHS England National CSOC assesses further exploitation as almost certain.

Introduction

Ivanti has released a security advisory to address two critical vulnerabilities in Ivanti Sentry. Successful exploitation could allow unauthenticated attackers to gain full administrative control or execute commands with root privileges on affected systems.

  • CVE-2026-10520 - Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection') vulnerability - CVSSv3 Score: 10.0
  • CVE-2026-10523 -  Authentication Bypass Using an Alternate Path or Channel vulnerability - CVSSv3 Score: 9.9

Threat updates

Date Update
11 Jun 2026 Exploitation of CVE-2026-10520 in the wild

Remediation advice

Affected organisations are encouraged to review Ivanti Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523) and apply the relevant updates as soon as possible.

Last edited: 11 June 2026 11:47 am