SecBoard
Zurück zur CVE-Übersicht

CVE-2026-105425

HIGH(7.2)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score29/100 — MITTEL
  • CVSS 7.2 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

2.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.2

Technische Schwere

Beschreibung

OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 10.7.4
  • 10.8.3
  • 11.0.0
  • 12.10.0.1
  • 12.9.0.3
  • 12.8.0.5

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("sentry", "epmm")
| where FileName in ("sh", "bash", "powershell.exe", "cmd.exe")
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c"

Splunk SPL

(sourcetype="linux_audit" OR sourcetype="windows_security") (process="sentry" OR process="epmm") (command="sh" OR command="bash" OR command="powershell.exe" OR command="cmd.exe") (commandline="-c" OR commandline="/c")

Sigma

title: Ivanti Sentry/EPMM OS Command Injection
status: experimental
description: Detects potential OS command injection attempts in Ivanti Sentry or EPMM by monitoring for suspicious child processes.
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: ['sentry', 'epmm']
    Image|endswith: ['/bin/sh', '/bin/bash', 'powershell.exe', 'cmd.exe']
    CommandLine|contains: [' -c ', ' /c ']
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - Image
tags:
  - attack.execution
  - cve.2026.105425

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable : ("sentry", "epmm")) and (process.executable : ("sh", "bash", "powershell.exe", "cmd.exe")) and (process.args : ("-c", "/c"))

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen