Critical OS Command Injection (CVE‑2026‑10520) in Ivanti Sentry Enables Root RCE – CISA Adds to KEV Catalog
What It Is – Ivanti Sentry, a secure mobile‑gateway appliance, contains a CVE‑2026‑10520 OS command‑injection flaw that grants unauthenticated attackers remote code execution with root privileges. The vulnerability has a CVSS 3.1 score of 10.0 (critical).
Exploitability – Public proof‑of‑concept code is available; Shadowserver reports active exploitation attempts and at least two compromised instances in the wild. CISA has placed the flaw in its Known Exploited Vulnerabilities (KEV) catalog and set a June 14 2026 patch deadline.
Affected Products – Ivanti Sentry R10.5.2, R10.6.2, R10.7.1 and earlier releases (secure gateway appliances deployed between corporate networks and mobile devices).
TPRM Impact – Because Sentry sits at the network edge, a successful compromise gives threat actors internal, trusted‑network access, enabling lateral movement, data exfiltration, and potential supply‑chain contamination of downstream vendors that rely on the gateway for mobile device management.
Recommended Actions –
- Patch immediately to Ivanti Sentry R10.5.2 / R10.6.2 / R10.7.1 or later (by June 14).
- Conduct network‑segmentation reviews to isolate Sentry appliances from critical assets.
- Deploy IDS/IPS signatures and monitor for exploitation attempts (e.g., unusual outbound traffic from Sentry IPs).
- Verify configuration hygiene – disable unnecessary services, enforce strong authentication, and restrict internet exposure.
- Include Sentry in third‑party risk inventories and reassess vendor risk scores until remediation is confirmed.
Source: Security Affairs – CISA adds Ivanti Sentry flaw to KEV catalog