Back Aiweekly.Co

Ivanti Sentry Pre-Auth RCE Scores Perfect CVSS 10

Aiweekly.Co • June 10, 2026

Government advisory adds official exploitation-status assessment: no active exploitation at disclosure, PoC expected soon, medium probability but high damage potential, lists all three patched branches.

Originally reported by labs.watchtowr.com

Original headline: watchTowr: Ivanti Sentry CVE-2026-10520 — Pre-Authenticated OS Command Injection Grants Unauthenticated Root RCE, CVSS 10/10, Patch Available

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Sentry Vulnerabilities Allow Remote Code Execution and Admin Access Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway, formerly MobileIron Sentry. The first, CVE-2026-10520, is an OS command injection flaw allowing remote code execution with root privileges, rated 10.0 on the CVSS scale. The second, CVE-2026-10523, is an authentication bypass vulnerability enabling unauthenticated attackers to create rogue administrative accounts, rated 9.9. Both vulnerabilities were disclosed on June 9, 2026, and patches were released on June 10, 2026, with no evidence of active exploitation reported at that time. However, researchers have already published proof-of-concept exploits, increasing the urgency for organizations to apply the patches. The vulnerabilities affect Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. Given the critical nature of these flaws, immediate action is recommended to mitigate potential risks. 26 sources 74

Extracted Entities

Ivanti Sentry Pre-Auth RCE Scores Perfect CVSS 10

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)