Ivanti Sentry Vulnerable Endpoint Request (CVE-2026-10520)

Ethan Andrews@eandrews

•updated Jun 10, 2026•1•0•10

This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.