CISA orders feds to patch actively exploited Ivanti flaw by Sunday
Source Bleeping Computer
Mentioned vulnerabilities
Rated High by Threat Radar from the Bleeping Computer text
Data as of 15 Jun 2026, 09:46 UTC
What to do
AI-suggested
Ivanti has released patches for CVE-2026-10520. U.S. federal agencies are mandated by CISA's Binding Operational Directive 26-04 to apply these patches within three days for exposed systems. Organizations should prioritize patching all Ivanti Sentry instances, especially those accessible from the internet. If patching is not immediately possible, discontinuing use of the affected product or applying any available mitigations per BOD 26-04 guidance is recommended. Since active exploitation is confirmed, unpatched systems should be considered compromised and remediated accordingly. Monitor vendor advisories for updates.
Description
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04. [...]