VORANT. Threat Intelligence Sign in Get the full feed

CISA flags exploited Ivanti Sentry command injection

high vulnerability government-national

CISA added CVE-2026-10520, an actively exploited OS command injection flaw in Ivanti Sentry, to its Known Exploited Vulnerabilities catalog.

CISA has updated its Known Exploited Vulnerabilities catalog to include CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry that is being actively exploited in the wild. The addition is based on confirmed evidence of exploitation, though CISA has not disclosed specific threat actor attribution or attack details.

The update coincides with CISA's Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities in the KEV catalog, particularly those on publicly exposed assets that grant total control post-exploitation. The directive also establishes expectations for compromise assessment before patching.

While the directive is mandatory only for federal agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV catalog remediation. Command injection vulnerabilities remain a common attack vector that allows adversaries to execute arbitrary system commands, potentially leading to full system compromise.

Mentioned in this report

Vulnerabilities CVE-2026-10520KEV

Detection guidance

Shell Spawned from Java/Tomcat Process on Ivanti Sentry Host (Possible Command Injection)

ATT&CK T1190

Detects a shell interpreter spawned by a Java or Tomcat process, consistent with exploitation of an OS command injection vulnerability in a Java-based appliance such as Ivanti Sentry. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned from Java/Tomcat Process on Ivanti Sentry Host
id: 7e2efbe2-3dc6-5002-912a-f7e089a2ca57
status: experimental
description: Detects a shell interpreter (sh, bash, dash) being spawned by a Java
  or Tomcat process, which is consistent with successful exploitation of an OS command
  injection vulnerability such as CVE-2026-10520 in Ivanti Sentry.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /java
    - tomcat
    - catalina
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter_admin:
    CommandLine|contains:
    - catalina.sh stop
    - catalina.sh start
  condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate startup/shutdown scripts invoking catalina.sh or similar Tomcat control
  scripts
- Administrative maintenance scripts that intentionally launch a shell from a Java
  service account
level: high

Reconnaissance Commands Executed via Web Application Service Account (Command Injection)

ATT&CK T1059

Detects common Linux reconnaissance commands (id, whoami, uname, cat /etc/passwd) executed by a process whose parent is a web/application server process, indicating possible post-exploitation of a command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Executed by Web Application Server Process
id: 1b679cc4-a0e4-5bac-9cce-2e68920c10dc
status: experimental
description: Detects execution of common reconnaissance commands (id, whoami, uname,
  cat /etc/passwd) with a parent process consistent with a web/application server,
  indicative of exploitation of an OS command injection vulnerability such as the
  one exploited in Ivanti Sentry (CVE-2026-10520).
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /java
    - tomcat
    - nginx
    - httpd
    - apache2
  selection_recon:
    Image|endswith:
    - /id
    - /whoami
    - /uname
    - /cat
    CommandLine|contains:
    - id
    - whoami
    - uname
    - /etc/passwd
  condition: selection_parent and selection_recon
falsepositives:
- Health-check or monitoring scripts that run id/whoami/uname from a service account
  for logging purposes
- Configuration management agents executing system inventory commands under the web
  server user
level: medium

Outbound Network Connection Initiated by Web/Java Process to Uncommon Port

ATT&CK T1190

Detects a Java/Tomcat/web-server process initiating an outbound connection to a non-standard remote port, which may indicate a reverse shell or C2 callback following exploitation of a command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Connection from Web Application Process to Uncommon Port
id: 3688eba2-61d1-52eb-b8a7-1b7e3be2d552
status: experimental
description: Detects a Java, Tomcat or web-server process establishing an outbound
  network connection to an uncommon destination port, which can indicate a reverse
  shell or command-and-control callback established after exploiting an OS command
  injection vulnerability such as CVE-2026-10520 in Ivanti Sentry.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
    - /java
    - tomcat
    - nginx
    - httpd
    - apache2
    Initiated: true
  filter_common_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
    - 53
  condition: selection and not filter_common_ports
falsepositives:
- Legitimate outbound integrations from the application server to internal APIs, LDAP,
  or database services on non-standard ports
- Update or license-check callbacks made by the appliance software itself
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/11/cisa-adds-one-known-exploited-vulnerability-catalog

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free