Back Feeds2.Feedburner

Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)

Feeds2.Feedburner •Zeljka Zorz • June 10, 2026

Ivanti has patched two critical vulnerabilities (CVE-2026-10520 and CVE-2026-10523) in Ivanti Sentry and has urged customers to implement the fix right away. Though the vulnerabilities are not known to be actively exploited, security researchers have already released technical details the former, which may be used by attackers to craft a working exploit. Ivanty Sentry and the vulnerabilities Ivanti Sentry is a security gateway that acts as a gatekeeper between mobile devices outside of … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Sentry Vulnerabilities Allow Remote Code Execution and Admin Access Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway, formerly MobileIron Sentry. The first, CVE-2026-10520, is an OS command injection flaw allowing remote code execution with root privileges, rated 10.0 on the CVSS scale. The second, CVE-2026-10523, is an authentication bypass vulnerability enabling unauthenticated attackers to create rogue administrative accounts, rated 9.9. Both vulnerabilities were disclosed on June 9, 2026, and patches were released on June 10, 2026, with no evidence of active exploitation reported at that time. However, researchers have already published proof-of-concept exploits, increasing the urgency for organizations to apply the patches. The vulnerabilities affect Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. Given the critical nature of these flaws, immediate action is recommended to mitigate potential risks. 26 sources 74

Extracted Entities

CVEs (2)

CVE-2026-10520 CVE-2026-10523