Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEVEU KEV

Published

2026-01-29

Status

Analyzed

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Weaknesses

CWE-94

Coverage 1

vulnerability

Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure

A critical vulnerability (CVE-2026-10520) in Ivanti Sentry was exploited within 24 hours of its disclosure, highlighting the speed at which attackers can react to newly released vulnerabilities. The flaw, an OS command i…

Dark Reading · Jun 11, 2026 Critical

CVE-2026-10520CVE-2026-10523CVE-2026-1340vulnerabilitycommand injectionroot access

All articles mentioning it

Advisories and references

• forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manage...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-...