AhnLab's Q2 2026 vulnerability trends report identifies 20,701 new CVEs, with Critical-severity vulnerabilities rising 62.5% from Q1 to 2,317. CISA's KEV catalog added 75 new entries, 87% of which were Critical or High severity. Attackers concentrated on externally exposed infrastructure (firewalls, VPNs, management panels) and supply chain compromises. The report highlights ten major CVEs across Ivanti, Fortinet, Palo Alto, Splunk, Google Chrome, Microsoft Exchange, cPanel, Ubiquiti, and DAEMON Tools, with RCE and privilege escalation being the dominant impact categories.
Ivanti Sentry
4 posts
Q2 2026 Vulnerability Trends Report - 105 minTen Operators, One Ivanti Sentry Command-Injection Endpoint
Within five days of exposing an Ivanti Sentry management surface to the internet, a controlled sensor recorded ten distinct operators attempting to exploit CVE-2026-10520, the CVSS 10.0 pre-authentication command-injection flaw that CISA had added to its Known Exploited Vulnerab…
Security Advisory 2026-008 Ivanti has disclosed two critical vulnerabilities in its Sentry products, including an OS command injection flaw (CVE-2026-10520) and an authentication bypass vulnerability (CVE-2026-10523). These vulnerabilities allow remote, unauthenticated attackers to achieve root-level remote code execution and create arbitrary administrative accounts on affected devices.
More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) Ivanti Sentry is affected by a critical pre-authenticated OS command injection vulnerability (CVE-2026-10520) and an authentication bypass vulnerability (CVE-2026-10523). The command injection flaw allows unauthenticated attackers to achieve root-level remote code execution by sending specially crafted XML payloads to the /mics/api/v2/sentry/mics-config/handleMessage endpoint.
