CISA flags exploited Ivanti Sentry command injection
CISA added CVE-2026-10520, an actively exploited OS command injection flaw in Ivanti Sentry, to its Known Exploited Vulnerabilities catalog.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-10520 as exploited in the wild.
CISA has updated its Known Exploited Vulnerabilities catalog to include CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry that is being actively exploited in the wild. The addition is based on confirmed evidence of exploitation, though CISA has not disclosed specific threat actor attribution or attack details.
The update coincides with CISA's Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities in the KEV catalog, particularly those on publicly exposed assets that grant total control post-exploitation. The directive also establishes expectations for compromise assessment before patching.
While the directive is mandatory only for federal agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV catalog remediation. Command injection vulnerabilities remain a common attack vector that allows adversaries to execute arbitrary system commands, potentially leading to full system compromise.
Mentioned in this report
Detection guidance
Shell Spawned from Java/Tomcat Process on Ivanti Sentry Host (Possible Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell interpreter spawned by a Java or Tomcat process, consistent with exploitation of an OS command injection vulnerability in a Java-based appliance such as Ivanti Sentry. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Java/Tomcat Process on Ivanti Sentry Host
id: 7e2efbe2-3dc6-5002-912a-f7e089a2ca57
status: experimental
description: Detects a shell interpreter (sh, bash, dash) being spawned by a Java
or Tomcat process, which is consistent with successful exploitation of an OS command
injection vulnerability such as CVE-2026-10520 in Ivanti Sentry.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /java
- tomcat
- catalina
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_admin:
CommandLine|contains:
- catalina.sh stop
- catalina.sh start
condition: selection_parent and selection_child and not filter_admin
falsepositives:
- Legitimate startup/shutdown scripts invoking catalina.sh or similar Tomcat control
scripts
- Administrative maintenance scripts that intentionally launch a shell from a Java
service account
level: high
Reconnaissance Commands Executed via Web Application Service Account (Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects common Linux reconnaissance commands (id, whoami, uname, cat /etc/passwd) executed by a process whose parent is a web/application server process, indicating possible post-exploitation of a command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands Executed by Web Application Server Process
id: 1b679cc4-a0e4-5bac-9cce-2e68920c10dc
status: experimental
description: Detects execution of common reconnaissance commands (id, whoami, uname,
cat /etc/passwd) with a parent process consistent with a web/application server,
indicative of exploitation of an OS command injection vulnerability such as the
one exploited in Ivanti Sentry (CVE-2026-10520).
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /java
- tomcat
- nginx
- httpd
- apache2
selection_recon:
Image|endswith:
- /id
- /whoami
- /uname
- /cat
CommandLine|contains:
- id
- whoami
- uname
- /etc/passwd
condition: selection_parent and selection_recon
falsepositives:
- Health-check or monitoring scripts that run id/whoami/uname from a service account
for logging purposes
- Configuration management agents executing system inventory commands under the web
server user
level: medium
Outbound Network Connection Initiated by Web/Java Process to Uncommon Port
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java/Tomcat/web-server process initiating an outbound connection to a non-standard remote port, which may indicate a reverse shell or C2 callback following exploitation of a command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection from Web Application Process to Uncommon Port
id: 3688eba2-61d1-52eb-b8a7-1b7e3be2d552
status: experimental
description: Detects a Java, Tomcat or web-server process establishing an outbound
network connection to an uncommon destination port, which can indicate a reverse
shell or command-and-control callback established after exploiting an OS command
injection vulnerability such as CVE-2026-10520 in Ivanti Sentry.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains:
- /java
- tomcat
- nginx
- httpd
- apache2
Initiated: true
filter_common_ports:
DestinationPort:
- 80
- 443
- 8080
- 8443
- 53
condition: selection and not filter_common_ports
falsepositives:
- Legitimate outbound integrations from the application server to internal APIs, LDAP,
or database services on non-standard ports
- Update or license-check callbacks made by the appliance software itself
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/11/cisa-adds-one-known-exploited-vulnerability-catalog
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs