High severity7.2NVD Advisory· Published Nov 10, 2026

CVE-2026-105425

Description

OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected products

Ivanti/Sentryllm-fuzzy
Range: <10.7.4, <10.8.3, <11.0.0
Ivanti/EPMMllm-fuzzy
Range: <12.10.0.1, <12.9.0.3, <12.8.0.5

Patches

Vulnerability mechanics

References

hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEsnvd
hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181nvd

News mentions

Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager
Cyber Security News · Nov 10, 2026

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000