Latest Ivanti Sentry vulnerabilities: CVE-2026-10520 and CVE-2026-10523 #
Ivanti disclosed that certain versions of Sentry are susceptible to two vulnerabilities.
- CVE-2026-10520: An OS command injection vulnerability allows a remote, unauthenticated attacker to achieve root-level remote code execution (RCE). This vulnerability has been designated CVE-2026-10520 and has been rated critical with a CVSS score of 10.0.
- CVE-2026-10523: An authentication bypass vulnerability allows a remote, unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. This vulnerability has been designated CVE-2026-10523 and has been rated critical with a CVSS score of 9.9.
Update (June 12, 2026): There is evidence that CVE-2026-10520 is being actively exploited in the wild.
The following versions are affected:
- Ivanti Sentry: Versions 10.5.1, 10.6.1, 10.7.0, and prior.
Note: Older, unsupported product versions have not been tested but are likely also affected.
What is Ivanti Sentry? #
Ivanti Sentry, formerly MobileIron Sentry, is an inline security gateway appliance that controls, encrypts, and isolates data traffic between remote mobile devices and a company's internal corporate servers based on device compliance rules set by a central management platform.
What is the impact? #
Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication, create administrative accounts, and execute arbitrary commands with root privileges, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Ivanti Sentry 10.5.x: Version 10.5.2 or later.
- Ivanti Sentry 10.6.x: Version 10.6.2 or later.
- Ivanti Sentry 10.7.x: Version 10.7.1 or later.
- All older, unsupported versions: Migrate to a supported, patched release.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially impacted assets:
_asset.protocol:http AND protocol:http AND
(last.http.body:"background-image:url(images/sentry-ivanti-logo-178x32.png)" OR
last.http.body:"background-image:url(images/sentry-mi-logo-300x40.png)")
