Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released.
Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges.
“An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution ” reads the advisory.
Ivanti Sentry is a secure gateway appliance that sits between an organization’s internal systems and mobile devices, helping companies manage and protect mobile access to corporate resources.
The vulnerability affects the secure mobile gateway used to protect communications between corporate systems and mobile devices. Although Ivanti initially reported no evidence of active attacks, researchers at Shadowserver found that many internet-exposed Sentry gateways had already been backdoored shortly after the security updates were released.
“We are observing a large amount of Ivanti Sentry CVE-2026-10520 exploitation attempts based on the public PoC today. We see 19 vulnerable instances in our own scans, with at least 2 backdoored (thanks to @NCA_KSA for the tip!). However, all remaining likely compromised too.” the Shadowserver Foundation posted on X. “While our detection is on the lowish side due to multiple Ivanti Sentry instances not reachable in our scans (blocklisted?), if you have not patched you are most likely compromised. Vuln IP data shared in Vulnerable HTTP reporting tagged ‘cve-2026-10520′”
Ivanti has not yet updated its advisory to confirm active exploitation of the issue in attacks in the wild. However, attackers frequently target Ivanti flaws because they can provide direct access into enterprise networks and enable data theft.
Threat actors can specifically target Ivanti Sentry instances mainly because they sit in a very sensitive and powerful position inside enterprise environments.
Ivanti Sentry acts as a gateway between mobile devices and internal corporate systems. That means if an attacker compromises it, they are no longer “outside” the network—they are effectively inside the trusted boundary.
Since January 2026, CISA has added multiple actively exploited Ivanti vulnerabilities to its KEV catalog, including CVE-2026-1340 affecting Endpoint Manager Mobile and CVE-2026-1603 affecting Endpoint Manager, both enabling attackers to bypass authentication or execute remote code and access sensitive enterprise systems.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
