Ivanti Sentry Critical Flaw Exploited in Under 24 Hours
Threat actors exploited CVE-2026-10520, a max-severity OS command injection flaw in Ivanti Sentry, within 24 hours of disclosure and public PoC release. The unauthenticated root-level RCE vulnerability was weaponized in active attacks. CISA and vendors urge immediate patching.
- systems-access
A critical vulnerability in Ivanti Sentry was exploited by threat actors less than 24 hours after its public disclosure and the release of proof-of-concept code. The flaw, tracked as CVE-2026-10520, allowed unauthenticated attackers to achieve root-level remote code execution through OS command injection. Public reporting indicates that the vulnerability has been actively used in real-world attacks, prompting urgent warnings from CISA and the vendor for organizations running the affected software.
Confirmed details from available reporting describe the vulnerability as maximum severity. It resides in Ivanti Sentry, a product used by many enterprises to manage mobile devices and secure access. The rapid exploitation timeline—under 24 hours from disclosure to active use—follows a pattern seen in previous high-profile vulnerabilities. No specific count of compromised organizations has been released, and the exact scope of systems-access data exposed remains unclear. However, successful root-level access typically grants attackers full control over the targeted appliance, including the ability to access connected networks, credentials, and configuration data.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →