June 9, 2026
Ivanti Security Advisory · June 2026
Total
4
Critical
2
Zero-day
2
KEV
2
2 zero-days / actively exploited
- CVE-2026-10520CVSS 10.0KEV
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
- CVE-2026-6973CVSS 7.2KEV
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
By product family
Unassigned2 CVEs
- CVE-2026-10523CVSS 9.9
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
- CVE-2026-10727CVSS 7.2
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root