Max-severity Ivanti Sentry flaw exploited for root code execution (CVE-2026-10520)

On 10 June 2026, Ivanti — the Utah-based enterprise IT and security vendor — disclosed and patched a pair of critical vulnerabilities in Ivanti Sentry, the gateway appliance (formerly MobileIron Sentry) that brokers access between mobile devices and corporate back-end systems. The headline flaw, CVE-2026-10520, carries the maximum CVSS score of 10.0: an unauthenticated, remote attacker can execute arbitrary operating-system commands as root.

What happened

CVE-2026-10520 is an OS command-injection bug in the ConfigServiceController class of the Sentry web application. Researchers traced it to the unauthenticated endpoint /mics/api/v2/sentry/mics-config/handleMessage, which parses an attacker-supplied message parameter as an internal configuration command and ultimately runs it as root. A companion flaw, CVE-2026-10523 (CVSS 9.9), is an authentication bypass that lets an attacker create arbitrary administrative accounts on the appliance. Both affect Sentry 10.5.1, 10.6.1, 10.7.0 and earlier, and are fixed in 10.5.2, 10.6.2 and 10.7.1.

Ivanti said it was not aware of active exploitation at the time of disclosure, but real-world attacks followed quickly once public exploit code circulated. The Shadowserver Foundation reported a surge in exploitation attempts and backdoored gateways exposed on the internet, and on 11 June CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch within three days — by 14 June 2026 — under Binding Operational Directive 26-04.

Why it matters

Sentry sits at the network edge, terminating connections from managed mobile devices, so an unauthenticated path to root on the appliance hands an attacker a beachhead with deep visibility into an organisation's mobility and identity infrastructure. Ivanti's edge products have been a recurring target, and this episode follows the now-familiar pattern in which a patched-but-trivially-exploitable bug is weaponised within hours of a public proof-of-concept — leaving defenders who delay measured not in weeks but in days.