ctipilot.ch

Ivanti Sentry pre-auth OS command injection to root (CVSS 10.0); watchTowr public PoC; companion CVE-2026-10523 auth bypass

cve · CVE-2026-10520

Coverage timeline
1
first 2026-06-10 → last 2026-06-10
Briefs
1
1 distinct
Sources cited
26
17 hosts
Sections touched
1
trending_vulns
Co-occurring entities
1
see Related entities below

Story timeline

  1. 2026-06-10CTI Daily Brief — 2026-06-10
    trending_vulnsFirst coverage. Public PoC same-day; no confirmed ITW; patch R10.5.2/R10.6.2/R10.7.1.

Where this entity is cited

  • trending_vulns1

Source distribution

  • cert.ssi.gouv.fr3 (12%)
  • helpnetsecurity.com3 (12%)
  • ivanti.com2 (8%)
  • nvd.nist.gov2 (8%)
  • security-hub.ncsc.admin.ch2 (8%)
  • securityweek.com2 (8%)
  • thehackernews.com2 (8%)
  • labs.watchtowr.com1 (4%)
  • other9 (35%)

Related entities

External references

NVD · cve.org · CISA KEV

All cited sources (26)

Items in briefs about Ivanti Sentry pre-auth OS command injection to root (CVSS 10.0); watchTowr public PoC; companion CVE-2026-10523 auth bypass (1)

CVE-2026-10520 / CVE-2026-10523 — Ivanti Sentry: pre-auth OS command injection to root (CVSS 10.0), public PoC published today

From CTI Daily Brief — 2026-06-10 · published 2026-06-10 · view item permalink →

CVE-2026-10520 is an unauthenticated OS command injection in Ivanti Sentry (formerly MobileIron Sentry), the EMM/MDM enforcement gateway that proxies email and applications to managed devices and frequently fronts Exchange. The vulnerable endpoint is /mics/api/v2/sentry/mics-config/handleMessage on the MICS admin API (port 8443): ConfigServiceController.handleMessage() accepts XML payloads containing commandexec blocks whose reqandres field is passed unvalidated through ConfigRequestProcessor.handleExecute() into native command execution, yielding root-level RCE with no authentication (watchTowr, 2026-06-10). watchTowr published the technical analysis and a working PoC on 2026-06-10; CVE-2026-10523 is a companion authentication bypass (CWE-288) covered in the same Ivanti advisory (watchTowr, 2026-06-10). No in-the-wild exploitation is confirmed yet, but a same-day public PoC against a pre-auth root RCE on a government-grade MDM gateway sharply compresses the window. Affected: all Sentry before R10.5.2 / R10.6.2 / R10.7.1; patch immediately and restrict the MICS interface (8443) to management IPs in the interim (T1190, T1059.004).