An OS Command Injection flaw exists in Ivanti Sentry that permits a remote attacker to execute arbitrary system commands with root privileges. The vulnerability is triggered by unsanitized input processed by the application, allowing the attacker to inject OS-level commands and gain full control over the host. The impact is total compromise of confidentiality, integrity, and availability of the affected system. This vulnerability falls under CWE-78: OS Command Injection.

Affected are Ivanti Sentry versions preceding R10.5.2, R10.6.2, and R10.7.1. Any deployment running an earlier release is susceptible, regardless of configuration, because the flaw resides in core components common to all those versions.

The CVSS score is 10, indicating critical severity. EPSS is not available, but the vulnerability is scored as unpatched and exposed to the internet, meaning it is likely to be targeted. The catalog indicates it is not yet in the CISA KEV list, but the attack vector inferred as remote unauthenticated access via network interfaces leads to actionable risk for all exposed installations.