CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Called exploited 1 day after disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last KEV listing1d
- Last sighting3mo
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Jun 11, 2026
- EUVDENISA, European Unionlisted Jun 11, 2026
- VulnCheck KEVcommercial researchlisted Jun 10, 2026
- CIRCLaggregator, mirrors the abovelisted Jun 10, 2026, not counted
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
67 public reports collected from VulnCheck and CIRCL, first on Jun 10, 2026. Each links to its original source. We have not verified them.
Description
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.