Critical Ivanti Sentry RCE Vulnerability CVE-2023-46807 Exploited in Attacks

Key Takeaways

• A critical command injection vulnerability in Ivanti Sentry (CVE-2026-10520) is under active exploitation.
• The flaw allows unauthenticated remote code execution with root privileges and has a CVSS score of 10.0.
• Ivanti Sentry versions 10.5.1, 10.6.1, 10.7.0, and earlier are affected.
• Patched versions 10.5.2, 10.6.2, and 10.7.1 are available, but many systems are already compromised.
• Attackers are deploying backdoors on vulnerable, internet-exposed appliances.

A severe command injection vulnerability impacting Ivanti Sentry appliances, identified as CVE-2026-10520, is being actively exploited in the wild. This development comes swiftly after a public proof-of-concept (PoC) exploit became available, with the Shadowserver Foundation confirming widespread attack attempts.

The flaw carries the highest possible CVSS score of 10.0, enabling remote, unauthenticated attackers to execute arbitrary code with root privileges on affected Ivanti Sentry systems.

Ivanti’s security advisory, issued on June 9, also addressed a secondary issue, CVE-2026-10523. Both vulnerabilities fall under the CWE-78 category (OS Command Injection). The affected Ivanti Sentry versions include 10.5.1, 10.6.1, 10.7.0, and all prior releases.

Ivanti has released patched versions 10.5.2, 10.6.2, and 10.7.1 to mitigate these issues. While the vendor initially reported no knowledge of active exploitation at the time of disclosure, real-world attacks quickly materialized following the public release of exploit code.

Ivanti Command Injection Vulnerability Exploitation Escalates

Shadowserver Foundation has documented a significant increase in exploitation attempts targeting Ivanti Sentry devices across the internet. Their telemetry indicates that at least 19 vulnerable Sentry instances were detected during recent scanning activities.

Of particular concern, at least two of these identified systems were confirmed to have been backdoored, signaling successful compromise. Researchers caution that the actual number of affected systems is likely much higher, as many instances might be shielded from external scans by firewalls or network configurations.

“If you have not patched, you are most likely compromised,” Shadowserver warned, emphasizing the rapid pace at which threat actors weaponized the vulnerability. Further intelligence suggests that attackers are not merely gaining access but are actively deploying persistent backdoors and injecting malicious code into compromised systems.

Shadowserver is now disseminating indicators of compromise through its Vulnerable HTTP and Compromised Website reporting feeds. Affected systems are being tagged with identifiers such as “cve-2026-10520” and “ivanti-sentry,injected-code,backdoor.”

This swift transition from vulnerability disclosure to active exploitation highlights a persistent trend, particularly with critical vulnerabilities in internet-facing edge devices. Such systems often become immediate targets once exploit details are publicly accessible.

Ivanti Sentry plays a crucial role in many enterprise environments, managing secure mobile devices and email. This makes it a high-value target for threat actors seeking initial access points into corporate networks.

What You Should Do

• Patch Immediately: Organizations utilizing Ivanti Sentry appliances must upgrade to patched versions 10.5.2, 10.6.2, or 10.7.1 without delay. Updated installation images and upgrade packages are available through Ivanti’s customer download portal.
• Conduct Compromise Assessments: Even after patching, security teams should perform thorough compromise assessments. This includes checking for signs of unauthorized access, suspicious processes, and any persistence mechanisms installed by attackers, especially on internet-exposed appliances.
• Implement Incident Response: Given confirmed backdoor deployments, incident response actions are strongly recommended. These include credential rotation for affected systems, detailed log analysis for anomalies, and comprehensive system integrity checks.
• Enhance Monitoring: Strengthen continuous monitoring of all edge infrastructure. The rapid exploitation of this vulnerability underscores the critical need for vigilant oversight and automated threat detection to identify and respond to attacks on newly disclosed flaws.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.