{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "EPMM versions ant\u00e9rieures \u00e0 12.7.0.2",
      "product": {
        "name": "Endpoint Manager Mobile (EPMM)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "EPMM versions 12.8.x ant\u00e9rieures \u00e0 12.8.0.3",
      "product": {
        "name": "Endpoint Manager Mobile (EPMM)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Sentry versions 10.6.x ant\u00e9rieures \u00e0 10.6.2",
      "product": {
        "name": "Sentry",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Sentry versions 10.7.x ant\u00e9rieures \u00e0 10.7.1",
      "product": {
        "name": "Sentry",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "EPMM versions 12.9.x ant\u00e9rieures \u00e0 12.9.0.1",
      "product": {
        "name": "Endpoint Manager Mobile (EPMM)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Sentry versions ant\u00e9rieures \u00e0 10.5.2",
      "product": {
        "name": "Sentry",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-6973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6973"
    },
    {
      "name": "CVE-2026-10523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10523"
    },
    {
      "name": "CVE-2026-10520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10520"
    },
    {
      "name": "CVE-2026-10727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10727"
    }
  ],
  "initial_release_date": "2026-06-10T00:00:00",
  "last_revision_date": "2026-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0724",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ivanti. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Ivanti",
  "vendor_advisories": [
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727",
      "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523",
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti june-2026-security-update",
      "url": "https://www.ivanti.com/blog/june-2026-security-update"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "Sentry",
          "vendor": "ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "R10.5.2"
            },
            {
              "status": "unaffected",
              "version": "R10.6.2"
            },
            {
              "status": "unaffected",
              "version": "R10.7.1"
            }
          ]
        }
      ],
      "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75"
    }
  ],
  "cisaActionDue": "2026-06-14",
  "cisaExploitAdd": "2026-06-11",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Ivanti Sentry OS Command Injection Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33107C3-2CB4-495C-ACB2-F1440ADAA2B0",
              "versionEndExcluding": "10.5.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5579D89-84ED-45BA-922F-B84DC5E3EE93",
              "versionEndExcluding": "10.6.2",
              "versionStartIncluding": "10.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ivanti:standalone_sentry:10.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F16798C-197D-4CED-BCD1-9C93A28D29D2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to achieve root-level remote code execution"
    }
  ],
  "id": "CVE-2026-10520",
  "lastModified": "2026-06-17T10:12:16.930",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10520",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T16:16:35.700",
  "references": [
    {
      "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520"
    }
  ],
  "sourceIdentifier": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10520"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T16:16:35Z",
    "severity": "CRITICAL"
  },
  "details": "An OS Command Injection vulnerability\u00a0in Ivanti\u00a0Sentry before\u00a0the\u00a0R10.5.2, R10.6.2 and R10.7.1\u00a0versions\u00a0allows\u00a0a remote unauthenticated user to achieve root-level remote code execution",
  "id": "GHSA-v2vc-rgvq-3pwf",
  "modified": "2026-06-11T21:31:50Z",
  "published": "2026-06-09T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10520"
    },
    {
      "type": "WEB",
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523"
    },
    {
      "type": "WEB",
      "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Ivanti heeft twee kwetsbaarheden verholpen in Sentry.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met kenmerk CVE-2026-10520, waarvan Ivanti een CVSS-score van 10 heeft toegekend, kan een ongeauthenticeerde kwaadwillende op afstand in staat stellen willekeurige code uitvoeren met root rechten. De kwetsbaarheid met kenmerk CVE-2026-10523, die Ivanti een CVSS score van 9.9, heeft gegeven, kan door een ongeauthenticeerde kwaadwillende op afstand worden misbruikt om administratieve accounts aan te maken.\n\nMisbruik van deze kwetsbaarheden is mogelijk, maar de randvoorwaarden die nodig zijn om deze kwetsbaarheden op afstand uit te buiten, vereisen dat een managementpoort aan het internet is ontsloten. Deze randvoorwaarden zijn niet aanwezig in standaardimplementaties van Ivanti Sentry.\n\nDe kwetsbaarheden hebben Ivanti bereikt via responsible disclosure. Momenteel vindt er, voor zover bekend, geen actief misbruik van deze kwetsbaarheden plaats en is er geen publieke PoC code beschikbaar. Het NCSC verwacht echter dat dit op korte termijn zal veranderen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Ivanti heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie voor meer informatie de referenties.",
        "title": "Oplossingen"
      },
      {
        "category": "description",
        "text": "Er is een gedetailleerde blogpost gepubliceerd waarin de kwetsbaarheden in detail worden uitgelegd. De publicatie van deze blogpost vergroot de kans op misbruik. Zie de blog van Watchtwr: https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/\n\nOok is PoC code beschikbaar: https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523",
        "title": "Dreigingsinformatie"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Authentication Bypass Using an Alternate Path or Channel",
        "title": "CWE-288"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
        "title": "CWE-78"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Ivanti Sentry",
    "tracking": {
      "current_release_date": "2026-06-11T11:11:03.648275Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0180",
      "initial_release_date": "2026-06-09T16:04:30.100537Z",
      "revision_history": [
        {
          "date": "2026-06-09T16:04:30.100537Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        },
        {
          "date": "2026-06-10T08:46:08.491420Z",
          "number": "1.0.1",
          "summary": "Er is een gedetailleerde blogpost gepubliceerd waarin de kwetsbaarheden in detail worden uitgelegd. Ook is inmiddels bekend dat de Ivanti Sentry via de Ivanti EPMM bereikt kan worden. De publicatie van deze blogpost vergroot de kans op misbruik."
        },
        {
          "date": "2026-06-11T11:11:03.648275Z",
          "number": "1.0.2",
          "summary": "PoC code publiek beschikbaar en aanpassing aanvalspad. "
        }
      ],
      "status": "final",
      "version": "1.0.2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Sentry"
          }
        ],
        "category": "vendor",
        "name": "Ivanti"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-10523",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authentication Bypass Using an Alternate Path or Channel",
          "title": "CWE-288"
        },
        {
          "category": "description",
          "text": "An Authentication Bypass vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 enables remote unauthenticated attackers to create arbitrary administrative accounts and gain full administrative privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-10523 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-10523.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-10523"
    },
    {
      "cve": "CVE-2026-10520",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "An OS Command Injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 enables remote unauthenticated attackers to execute code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-10520 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-10520.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-10520"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Ivanti Sentry ist ein Inline-Gateway, das den Datenverkehr zwischen dem mobilen Ger\u00e4t und den Back-End-Unternehmenssystemen verwaltet, verschl\u00fcsselt und sichert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ivanti Sentry ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuf\u00fchren und Administratorrechte zu erlangen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1841 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1841.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1841 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1841"
      },
      {
        "category": "external",
        "summary": "Ivanti Security Advisory vom 2026-06-09",
        "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"
      },
      {
        "category": "external",
        "summary": "Watchtowr Labs CVE-2026-10520 PoC",
        "url": "https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/"
      }
    ],
    "source_lang": "en-US",
    "title": "Ivanti Sentry: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-11T11:06:01.474+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1841",
      "initial_release_date": "2026-06-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-10T22:00:00.000+00:00",
          "number": "2",
          "summary": "Exploit aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.5.2",
                "product": {
                  "name": "Ivanti Sentry \u003c10.5.2",
                  "product_id": "T055090"
                }
              },
              {
                "category": "product_version",
                "name": "10.5.2",
                "product": {
                  "name": "Ivanti Sentry 10.5.2",
                  "product_id": "T055090-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:sentry:10.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.6.2",
                "product": {
                  "name": "Ivanti Sentry \u003c10.6.2",
                  "product_id": "T055091"
                }
              },
              {
                "category": "product_version",
                "name": "10.6.2",
                "product": {
                  "name": "Ivanti Sentry 10.6.2",
                  "product_id": "T055091-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:sentry:10.6.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.7.1",
                "product": {
                  "name": "Ivanti Sentry \u003c10.7.1",
                  "product_id": "T055092"
                }
              },
              {
                "category": "product_version",
                "name": "10.7.1",
                "product": {
                  "name": "Ivanti Sentry 10.7.1",
                  "product_id": "T055092-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:sentry:10.7.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Sentry"
          }
        ],
        "category": "vendor",
        "name": "Ivanti"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-10520",
      "product_status": {
        "known_affected": [
          "T055092",
          "T055091",
          "T055090"
        ]
      },
      "release_date": "2026-06-09T22:00:00.000+00:00",
      "title": "CVE-2026-10520"
    },
    {
      "cve": "CVE-2026-10523",
      "product_status": {
        "known_affected": [
          "T055092",
          "T055091",
          "T055090"
        ]
      },
      "release_date": "2026-06-09T22:00:00.000+00:00",
      "title": "CVE-2026-10523"
    }
  ]
}