Successful Ivanti Sentry RCE Response (CVE-2026-10520)

Ethan Andrews@eandrews

•updated Jun 10, 2026•1•0•16

This rule detects successful exploitation attempts against the Ivanti Sentry vulnerability CVE-2026-10520, which is a pre-authentication OS command injection. It specifically looks for HTTP 200 OK responses to requests targeting the vulnerable configuration endpoint '/mics/api/v2/sentry/mics-config/handleMessage'. A 200 OK status indicates that the request was successfully processed, suggesting a potential successful command injection.