Ivanti Patches Critical Sentry Vulnerabilities Enabling Root-Level Remote Code Execution

Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway, including CVE-2026-10520, a pre-authentication OS command injection flaw enabling unauthenticated remote attackers to execute commands as root on an internet-facing perimeter appliance. CISA has added the CVE to its Known Exploited Vulnerabilities Catalog and issued a binding operational directive requiring US federal civilian agencies to patch within three days. Multiple outlets report in-the-wild exploitation within roughly 24 hours of disclosure. Vendor patches are available; the scope of compromised organisations and any named insured losses remain undisclosed.

AI-generated from linked source reports. See our correction policy.