Ivanti: Max severity Sentry flaw allows code execution as root
Source Bleeping Computer
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 06/11/2026, 10:03:46 UTC
What to do
AI-suggested
Ivanti has released official patches addressing both vulnerabilities in Sentry versions R10.5.2, R10.6.2, and R10.7.1. Administrators should upgrade to one of these versions immediately to remediate the issues. There is no evidence of exploitation in the wild, but timely patching is essential to prevent potential attacks.
Description
Ivanti has patched two critical vulnerabilities in its Sentry secure mobile gateway solution, including a maximum-severity flaw that enables remote attackers to execute code with root privileges. [...]
Impact
Successful exploitation of CVE-2026-10520 allows remote attackers to execute arbitrary code with root privileges on the Ivanti Sentry appliance, potentially compromising the entire system. CVE-2026-10523 enables unauthenticated attackers to bypass authentication controls, create rogue administrative accounts, and gain full administrative access, leading to complete system takeover. These vulnerabilities pose a critical risk to the confidentiality, integrity, and availability of affected systems.