Critical OS Command Injection (CVE‑2026‑10520) in Ivanti Sentry Gateways Actively Exploited Post‑Patch
What It Is — CVE‑2026‑10520 is a maximum‑severity OS command‑injection flaw in Ivanti Sentry secure‑gateway appliances that allows an unauthenticated attacker to execute arbitrary commands with root privileges.
Exploitability — A public PoC is available; Shadowserver reported active exploitation attempts and at least two back‑doored devices within days of the patch release. CVSS v3.1 = 9.8 (Critical).
Affected Products — Ivanti Sentry versions prior to R10.5.2, R10.6.2 and R10.7.1 (gateway appliances that mediate mobile‑device access to corporate resources).
TPRM Impact — Compromise of a third‑party gateway provides attackers a foothold inside customer networks, enabling lateral movement, data exfiltration, and service disruption for any organization that relies on the appliance.
Recommended Actions —
- Verify every Sentry instance runs the latest patched release; if not, apply the patch immediately and isolate the device from production traffic.
- Run external scans and IOC‑based hunting (e.g., Shadowserver’s “cve‑2026‑10520” tags) to detect compromised gateways.
- Review segmentation and authentication controls around gateway appliances; enforce least‑privilege network zones.
- Contact Ivanti for forensic guidance, request detailed compromise indicators, and consider a third‑party audit of mobile‑access architecture.
Source: Security Affairs