{"id":"CVE-2026-105425","kind":"vulnerability","aliases":["CVE-2026-105425"],"related":[],"title":"Ivanti Sentry and EPMM: admin users can run commands on the server","description":"OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.","summary":"Ivanti Sentry and Ivanti EPMM contain an OS command injection flaw that lets a logged-in administrator pass commands to the operating system. The sources say this leads to remote code execution on the server.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epmm","ivanti","self-hosted","sentry","vendor"],"not_affected_if":["fixed-version","non-admin-only-accounts"],"how_to_check":"- Check the installed Ivanti Sentry version against the fixed versions listed in the sources (`10.7.4`, `10.8.3`, `11.0.0`).\n- Check the installed Ivanti EPMM version against the fixed versions listed in the sources (`12.10.0.1`, `12.9.0.3`, `12.8.0.5`).\n- Review which accounts hold admin privileges on these appliances.","fix":"- Ivanti Sentry: move to `10.7.4`, `10.8.3`, or `11.0.0` or later on the matching release line.\n- Ivanti EPMM: move to `12.10.0.1`, `12.9.0.3`, or `12.8.0.5` or later on the matching release line.","status":"open","published_at":"2026-11-10T16:17:13+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:23:28+00:00","updated_at":"2026-11-10T16:23:28+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T16:23:28Z","model":"claude-haiku-5-5","output":{"fix":"- Ivanti Sentry: move to `10.7.4`, `10.8.3`, or `11.0.0` or later on the matching release line.\n- Ivanti EPMM: move to `12.10.0.1`, `12.9.0.3`, or `12.8.0.5` or later on the matching release line.","reach":"network","title":"Ivanti Sentry and EPMM: admin users can run commands on the server","impact":"high","summary":"Ivanti Sentry and Ivanti EPMM contain an OS command injection flaw that lets a logged-in administrator pass commands to the operating system. The sources say this leads to remote code execution on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti","sentry","epmm","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands on the server as an admin.","analyst_note":"","how_to_check":"- Check the installed Ivanti Sentry version against the fixed versions listed in the sources (`10.7.4`, `10.8.3`, `11.0.0`).\n- Check the installed Ivanti EPMM version against the fixed versions listed in the sources (`12.10.0.1`, `12.9.0.3`, `12.8.0.5`).\n- Review which accounts hold admin privileges on these appliances.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","non-admin-only-accounts"],"who_is_affected":"Organizations running Ivanti Sentry or Ivanti EPMM on the affected versions are exposed. The attacker needs admin privileges on the product, so exposure depends on who holds those accounts. Installations already on a fixed version in each release line are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4581,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105425':15A,18A '-2026':14A,17A '10.7.4':70C '10.8.3':71C '11.0.0':73C '12.10.0.1':82C '12.8.0.5':85C '12.9.0.3':83C 'achiev':95C 'admin':5A,92C 'administr':43B 'allow':86C 'attack':90C 'authent':89C 'code':57B,97C 'command':9A,34B,45B,63C 'contain':31B 'cve':13A,16A 'epmm':4A,19B,30B,79C 'execut':58B,98C 'flaw':36B 'host':23B 'inject':35B,64C 'ivanti':1A,20B,26B,29B,66C,78C 'lead':54B 'let':38B 'log':41B 'logged-in':40B 'oper':48B 'os':33B,62C 'pass':44B 'privileg':93C 'remot':56B,88C,96C 'run':8A 'say':52B 'self':22B 'self-host':21B 'sentri':2A,24B,27B,67C 'server':12A,61B 'sourc':51B 'system':49B 'user':6A 'vendor':25B 'version':69C,81C 'well':75C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Ivanti Sentry or Ivanti EPMM on the affected versions are exposed. The attacker needs admin privileges on the product, so exposure depends on who holds those accounts. Installations already on a fixed version in each release line are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["epmm","high","ivanti","selfhosted","sentry","vendor"],"campaign_type":null,"search_a":"'-105425':15A,18A '-2026':14A,17A 'admin':5A 'command':9A 'cve':13A,16A 'epmm':4A 'ivanti':1A 'run':8A 'sentri':2A 'server':12A 'user':6A","search_b":"'administr':43B 'code':57B 'command':34B,45B 'contain':31B 'epmm':19B,30B 'execut':58B 'flaw':36B 'host':23B 'inject':35B 'ivanti':20B,26B,29B 'lead':54B 'let':38B 'log':41B 'logged-in':40B 'oper':48B 'os':33B 'pass':44B 'remot':56B 'say':52B 'self':22B 'self-host':21B 'sentri':24B,27B 'server':61B 'sourc':51B 'system':49B 'vendor':25B","search_c":"'10.7.4':70C '10.8.3':71C '11.0.0':73C '12.10.0.1':82C '12.8.0.5':85C '12.9.0.3':83C 'achiev':95C 'admin':92C 'allow':86C 'attack':90C 'authent':89C 'code':97C 'command':63C 'epmm':79C 'execut':98C 'inject':64C 'ivanti':66C,78C 'os':62C 'privileg':93C 'remot':88C,96C 'sentri':67C 'version':69C,81C 'well':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105425","severity":null,"published_at":"2026-11-10T16:17:13+00:00","modified_at":"2026-11-10T16:17:13+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}