Ivanti Security Advisory · June 2026
IvantiScheduled
4
Total
Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.
2
Critical
CVEs with CVSS 9.0 or higher (critical per NVD scale).
2
Zero-day
Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).
2
KEV
Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.
2 zero-days / actively exploited
These vulnerabilities were exploited before or at the time the patch was released. Install the related updates first.
| Severity | CVE | Description | KB article | CVSS |
|---|---|---|---|---|
| Critical | CVE-2026-10520 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution Listed in CISA KEV | — | 10.0 |
| High | CVE-2026-6973 | An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution. Listed in CISA KEV | — | 7.2 |
By product family
Unassigned2 CVEs
| Severity | CVE | Description | KB article | CVSS |
|---|---|---|---|---|
| Critical | CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access | — | 9.9 |
| High | CVE-2026-10727 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root | — | 7.2 |