CVE-2026-10520 is an OS command injection vulnerability in Ivanti Sentry security gateway appliances that allows remote attackers to execute arbitrary operating system commands. The vulnerability was patched by Ivanti, but shortly after patch release, Shadowserver reported active exploitation and backdooring of exposed Ivanti Sentry instances on the internet. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog and issued Binding Operational Directive 26-04, requiring U.S. federal agencies to patch exposed systems within three days. The directive emphasizes the high risk posed by this vulnerability due to its exploitation potential and impact on federal enterprise security. Ivanti has not yet updated its advisory to acknowledge active exploitation, and the exact number of compromised systems may be higher than detected due to scanning limitations.

Successful exploitation of CVE-2026-10520 enables attackers to execute arbitrary OS commands on vulnerable Ivanti Sentry appliances, potentially leading to full system compromise. Shadowserver's findings of backdoored systems indicate attackers have established persistent unauthorized access. The vulnerability is actively exploited in the wild, targeting internet-exposed Ivanti Sentry admin portals. This poses significant risks including unauthorized control over security gateway appliances, which can impact network security and data integrity within affected organizations, especially federal agencies.

Ivanti has released patches for CVE-2026-10520. U.S. federal agencies are mandated by CISA's Binding Operational Directive 26-04 to apply these patches within three days for exposed systems. Organizations should prioritize patching all Ivanti Sentry instances, especially those accessible from the internet. If patching is not immediately possible, discontinuing use of the affected product or applying any available mitigations per BOD 26-04 guidance is recommended. Since active exploitation is confirmed, unpatched systems should be considered compromised and remediated accordingly. Monitor vendor advisories for updates.