--- title: More Evidence That Words Don't Mean What We Thought They... description: WatchTowr Labs analyzes CVE-2026-10520, a CVSS 10.0 pre-authenticated OS command injection vulnerability in Ivanti Sentry. The research walks through diffing... canonical: https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) | daily.dev og:description: WatchTowr Labs analyzes CVE-2026-10520, a CVSS 10.0 pre-authenticated OS command injection vulnerability in Ivanti Sentry. The research walks through diffing... og:url: https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz og:image: https://api.daily.dev/og/posts/3tQbOGeMz.png og:image:alt: More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) **[watchTowr Labs](https://daily.dev/sources/watchtowr-labs)** · 10 min read · 0 upvotes · 0 comments ## Summary WatchTowr Labs analyzes CVE-2026-10520, a CVSS 10.0 pre-authenticated OS command injection vulnerability in Ivanti Sentry. The research walks through diffing the vulnerable vs. patched JAR files, tracing the execution path from a Spring Boot controller endpoint (/mics/api/v2/sentry/mics-config/handleMessage) through the configuration service to an executeNativeCommand() method. The patch replaces user-controlled input with a hardcoded command and adds Apache-level regex rules to block unauthenticated access. A proof-of-concept demonstrating RCE via a crafted XML commandexec payload is included, along with a detection artifact generator on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry](https://daily.dev/posts/cve-2026-10520-cve-2026-10523---multiple-critical-vulnerabilities-affecting-ivanti-sentry-uxvwlkgex) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [Max severity Ivanti Sentry vulnerability now exploited in attacks](https://daily.dev/posts/max-severity-ivanti-sentry-vulnerability-now-exploited-in-attacks-17nw2pxpe) · BleepingComputer · 0 upvotes · 0 comments - [Ivanti: Max severity Sentry flaw allows code execution as root](https://daily.dev/posts/ivanti-max-severity-sentry-flaw-allows-code-execution-as-root-h8hixzuel) · BleepingComputer · 0 upvotes · 0 comments - [Ivanti patches critical Sentry flaws that lead to full device takeover](https://daily.dev/posts/ivanti-patches-critical-sentry-flaws-that-lead-to-full-device-takeover-uuwutwn8p) · CSO Online · 0 upvotes · 0 comments - [Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9](https://daily.dev/posts/ivanti-tells-sentry-customers-to-patch-now-as-critical-bugs-hit-10-0-and-9-9-f3ulvlxlq) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)","url":"https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz"},"datePublished":"2026-06-10T00:52:57.108Z","dateModified":"2026-06-10T00:53:20.709Z","description":"WatchTowr Labs analyzes CVE-2026-10520, a CVSS 10.0 pre-authenticated OS command injection vulnerability in Ivanti Sentry. The research walks through diffing...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d7ce4ef13394daef2e85991dc1bd718?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d7ce4ef13394daef2e85991dc1bd718?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"watchTowr Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"watchTowr Labs","logo":"https://media.daily.dev/image/upload/s--6_x7BAvI--/f_auto,q_auto/v1774959933/logos/watchtowr-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/watchtowr-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/more-evidence-that-words-don-t-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-in-3tqbogemz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,reverse-engineering","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"watchTowr Labs","item":"https://daily.dev/sources/watchtowr-labs"},{"@type":"ListItem","position":3,"name":"More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)"}]} ```