Ivanti Sentry command injection CVE-2026-10520 used in attacks; fixes available
Attackers are exploiting CVE-2026-10520 to take over exposed Ivanti Sentry business gateways without logging in. Ask IT to install R10.5.2, R10.6.2 or R10.7.1 or later, restrict access and check for compromise.
If your workplace or family office uses Ivanti Sentry, ask IT to update to R10.5.2, R10.6.2 or R10.7.1 or a later supported release, restrict access to its management interfaces and investigate possible compromise. Families do not need to update their phones for this flaw; the affected system is the organisation's gateway.
What’s happening
Ivanti Sentry, formerly MobileIron Sentry, is a business gateway between mobile devices and corporate systems such as email servers. CVE-2026-10520 lets a remote attacker who can reach the vulnerable interface run code with full system privileges without logging in. Ivanti disclosed the flaw on 9 June and identifies R10.5.2, R10.6.2 and R10.7.1 as fixed releases. Although Ivanti initially reported no known customer exploitation, CISA confirmed exploitation by adding it to its catalogue on 11 June. Shadowserver also reported backdoored appliances, and its feed recorded further attack attempts on 19 July. The reviewed sources do not establish the total number of victims or that attacks have ended. As of 3 November, the identified fixes remain available. Ivanti's advisory portal could not be retrieved during verification; version details come from its published CVE record.
- What
- Flaw
- Affects
- Ivanti Sentry (formerly MobileIron Sentry)
- Affected
- Ivanti Sentry 10.5.1 and earlier
Ivanti Sentry 10.6.1 and earlier in the 10.6 branch
Ivanti Sentry 10.7.0 - Fixed in
- Ivanti Sentry R10.5.2
Ivanti Sentry R10.6.2
Ivanti Sentry R10.7.1 - Since
- 9 June 2026
- Closed
- 19 July 2026
Timeline
- Update
A Shadowserver feed entry reproduced by CIRCL recorded 18 honeypot connections associated with exploitation attempts that day. This indicates continued attempts, rather than 18 confirmed compromises.
- CISA added
CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 14 June for US federal civilian agencies.
- Wider attacks
Help Net Security reported Shadowserver's observation of widespread exploitation attempts. Shadowserver had identified 19 vulnerable instances, at least two with backdoors.
- Made publicFixed
Ivanti disclosed CVE-2026-10520, which lets an attacker run code with full system privileges without logging in. Its CVE record identifies R10.5.2, R10.6.2 and R10.7.1 as fixed versions.
Sources
- CVE-2026-10520 — Ivanti-authored CVE recordIvanti · 9 June 2026
- Critical vulnerabilities in Ivanti SentryCERT-EU · 10 June 2026
- Ivanti: Max severity Sentry flaw allows code execution as rootBleepingComputer · 10 June 2026
- Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)Help Net Security · 11 June 2026
- Ivanti Releases Security Advisory for Critical Vulnerabilities in SentryNHS England · 11 June 2026
- CVE-2026-10520 DetailNIST · 9 June 2026
- CVE-2026-10520 — Shadowserver exploitation observationsCIRCL · 21 July 2026