Back Feeds.4Sysops

Ivanti releases urgent patches for critical Sentry and EPMM vulnerabilities

Feeds.4Sysops •IT News • June 10, 2026

Ivanti has issued emergency updates for its Sentry mobile gateway and Endpoint Manager Mobile (EPMM) platforms to address several critical security flaws. The most severe issue, CVE-2026-10520, is an OS command injection vulnerability with a maximum CVSS score of 10.0. This flaw allows remote, unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted messages to an exposed API. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Sentry Vulnerabilities Allow Remote Code Execution and Admin Access Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway, formerly MobileIron Sentry. The first, CVE-2026-10520, is an OS command injection flaw allowing remote code execution with root privileges, rated 10.0 on the CVSS scale. The second, CVE-2026-10523, is an authentication bypass vulnerability enabling unauthenticated attackers to create rogue administrative accounts, rated 9.9. Both vulnerabilities were disclosed on June 9, 2026, and patches were released on June 10, 2026, with no evidence of active exploitation reported at that time. However, researchers have already published proof-of-concept exploits, increasing the urgency for organizations to apply the patches. The vulnerabilities affect Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. Given the critical nature of these flaws, immediate action is recommended to mitigate potential risks. 38 sources 74

Extracted Entities

Ivanti releases urgent patches for critical Sentry and EPMM vulnerabilities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Tools (1)