Exploiting CVE-2026-10520: Ivanti Sentry Vulnerability in Phishing Campaigns

Campaign or TTP Overview

In early 2026, a critical vulnerability identified as CVE-2026-10520 emerged within Ivanti Sentry. This vulnerability allows for OS command injections by remote unauthenticated users, granting them potentially devastating root-level remote code execution capabilities on unmanaged devices. This vulnerability has caught the interest of threat actors, leading to an uptick in phishing campaigns exploiting it. According to CISA’s Known Exploited Vulnerabilities Catalog, attackers specifically targeted organizations relying heavily on Ivanti Sentry for secure mobile connectivity, typically in sectors managing sensitive data or performing remote device management.

The campaign predominantly aimed at large enterprises and healthcare institutions, where deploying devices with management suites like Ivanti Sentry is common. Phishing emails were crafted to appear as urgent security notices, supposedly from the victim’s IT department, with the intent to deceive recipients into executing malicious commands inadvertently. This activity has not been conclusively attributed to a single threat actor, but the tactics align with groups known for exploiting zero-day vulnerabilities.

How It Was Built

The technical sophistication behind these phishing campaigns lay in their infrastructure and delivery mechanisms. Attackers used compromised email servers to send out emails that passed SPF and DMARC checks, increasing their likelihood of delivery. The email subject lines often read: “Immediate Security Update Required for Your Device” or “Urgent: Action Needed to Secure Your Connection.” These lines masked the true malicious intent behind a facade of urgency and legitimacy.

The emails contained links leading to a cloned Ivanti Sentry login page designed to harvest credentials. Once the target entered their credentials, the page delivered a payload exploiting the CVE-2026-10520 vulnerability. This payload was typically embedded in a JavaScript file, which, once executed, allowed attackers to inject commands into the operating system to acquire root permissions.


POST /update

Host: fakeIvantiSentry.com

Content-Type: application/x-www-form-urlencoded



cmd=rm%20-rf%20%2f%20%7C%7C%20echo%20'No%20Problems'

Domain patterns used in these attacks mimicked legitimate Ivanti instances using look-alike domains such as ivantisecurity-updates.com, further adding to the disguise. The email sender fields were spoofed with internal IT support team aliases, a detail that effectively manipulated trust assumptions common in internal communications.

Why It Worked

The success of this campaign was contingent upon several strategic elements. First, the use of compromised mail servers ensured that the emails could bypass security gateways designed to weed out phishing attempts based purely on suspicious mail headers. The carefully curated subject lines instilled urgency—leveraging fear and authority, two potent psychological levers in phishing.

Secondly, the credibility of the cloned Ivanti Sentry login page significantly increased the likelihood of credential submission. The attackers paid meticulous attention to reproducing not only visual design but also functional elements such as fake security certificates that mimicked genuine communication exchanges, deceiving even the trained eye.

Additionally, the embedding of the payload in a JavaScript delivery method was crucial. JavaScript’s ubiquity allows for seamless execution across most environments, effectively enabling the payload to run unnoticed once initiated by the user.

Operator Takeaways

For red teams seeking to replicate this campaign’s success, mirroring the attackers’ precise attention to detail offers the greatest value. Begin by securing access to compromised email servers to facilitate more authentic email delivery strategies. Experiment with specific clone sites that mirror high-value target services such as Ivanti Sentry. Use believable sender details and domain names that closely match genuine counterparts.

Furthermore, consider implementing a multi-stage engagement wherein you not only acquire credentials but also further exploit technical vulnerabilities like OS command injection. This approach mimics real-world attacker persistence and delves into deeper systemic exploitation, enabling organizations to measure not just initial defense failure points but secondary response capacities.

Good / Better / Best

Good: Aligning phish domain names closely with legitimate ones.

Better: Using compromised mail servers that pass SPF and DMARC checks to enhance deliverability.

Best: Deploying advanced cloned login pages with dynamic content that can mimic genuine exchanges, including fake security certificates.

References

CISA’s Known Exploited Vulnerabilities Catalog

Security Lab: Exploit Campaign Analysis of Ivanti Sentry

Exploiting CVE-2026-10520: Ivanti Sentry Vulnerability in Phishing Campaigns

Related Reading