Ivanti Standalone Sentry vulnerabilities

4 CVEs affecting Ivanti Standalone Sentry, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10523, published 2026-06-09.

More from Ivanti.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability, published 2026-06-09. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2026-06-11. EPSS: 99.9% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
• CVE-2026-10523, published 2026-06-09. Critical severity, CVSS 9.8. EPSS: 53.1% chance of exploitation in the next 30 days. An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts…
• CVE-2023-41724, published 2024-03-31. High severity, CVSS 8.8. EPSS: 12.8% chance of exploitation in the next 30 days. A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the…
• CVE-2024-8540, published 2024-12-10. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components.