This vulnerability (CVE-2026-10520) in Ivanti Sentry involves improper neutralization of special elements used in OS commands (CWE-78), enabling remote unauthenticated users to perform OS command injection. Exploitation results in root-level remote code execution. The affected versions are those before R10.5.2, R10.6.2, and R10.7.1. The CVSS v3.1 base score is 10.0, reflecting its critical impact with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability compromise. No official remediation level or patch links are provided in the data, and no known exploits in the wild are reported.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands with root privileges on affected Ivanti Sentry systems. This results in full system compromise, including complete loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Ivanti's advisories closely and apply updates for versions R10.5.2, R10.6.2, and R10.7.1 once available. Until then, restrict network access to Ivanti Sentry instances and consider additional network-level protections to limit exposure.