Critical · published June 9, 2026
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 An unguarded command line is an open invitation! This OS Command Injection in Ivanti Sentry allows remote unauthenticated users to execute code as root — absolute mayhem awaits! 🔥 Think of it like a stadium with no security checks at the gate; anyone can walk in and commandeer the sound system, blasting whatever music they choose. Without proper controls, it’s a recipe for disaster! An attacker could exploit this vulnerability to take complete control of affected systems, leading to unauthorized access, data breaches, and potentially crippling the operations of your organization. Imagine an intruder turning the lights off, silencing the crowd, and causing chaos — that’s the level of disruption at stake here!
Think of it like a stadium with no security checks at the gate; anyone can walk in and commandeer the sound system, blasting whatever music they choose. Without proper controls, it’s a recipe for disaster! This vulnerability allows a remote unauthenticated user to inject arbitrary operating system commands into vulnerable parameters of the Ivanti Sentry software versions before R10.5.2, R10.6.2, and R10.7.1, resulting in root-level code execution on the server.
An attacker could exploit this vulnerability to take complete control of affected systems, leading to unauthorized access, data breaches, and potentially crippling the operations of your organization. Imagine an intruder turning the lights off, silencing the crowd, and causing chaos — that’s the level of disruption at stake here! Act swiftly! Upgrade your Ivanti Sentry installations to versions R10.5.2, R10.6.2, or R10.7.1 immediately. Review your security policies to ensure no unauthorized commands can be executed by external users. 🛡️ You’ve got this! With these updates, you’ll restore security and keep your system safe. Let's lock it down! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/standalone_sentry | < 10.5.2 | 10.5.2 |
| ivanti/standalone_sentry | ≥ 10.6.0, < 10.6.2 | 10.6.2 |
| ivanti/standalone_sentry | all versions | — |