CVE-2026-10520Vulnerability
Ivanti Sentry OS Command Injection Vulnerability
Reported by 5 independent sources · first reported by watchTowr Labs · last reported
Last reported 16 days ago
Fix due 14 Jun 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers“The team first came across PoeLLM while looking into an Ivanti Sentry vulnerability (CVE-2026-10520).”
-
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers“The threat hunters first spotted the PoeLLM malware while investigating an Ivanti Sentry vulnerability, CVE-2026-10520.”
-
June 2026 CVE Landscape“CVE-2026-10520”
-
Don't Eat the ChocoPoCs: Trojanised PoCs Hit Researchers“…al vulnerability affects a large attack surface - such as React2Shell (CVE-2025-55182), FortiWeb (CVE-2025-64446), or Ivanti Sentry (CVE-2026-10520) - every hour counts to produce a scan module before attackers weaponise and mass-exploit the vulnerability.”
-
More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)“More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)”
Indicators reported together
named in the same reports- 5.78.73[.]122in 2 reports
Copy this indicator · defanged
Also named with it: CVE-2025-55182, CVE-2026-42271, CVE-2026-50751, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2026-21509, CVE-2025-8088, CVE-2025-6218, CVE-2026-35273, CVE-2021-27137, CVE-2026-46817, CVE-2026-48907, CVE-2026-48908, CVE-2026-0257
Thanks — we review every report.