A maximum-severity flaw in Ivanti Sentry, a security gateway used to manage and protect mobile and email access, is being actively exploited. Attackers can take complete control of an affected device without needing a password.

• What it is: CVE-2026-10520, an unauthenticated command injection vulnerability rated 10.0 (the highest possible severity). It allows remote attackers to run commands as the root (administrator) user.
• Who is affected: Organisations running Ivanti Sentry versions 10.7.0, 10.6.1, 10.5.1 and earlier.
• The risk: Exploitation began within days of a public proof-of-concept being released. Security researchers have already found internet-facing devices that have been compromised and backdoored.
• What to do: Apply Ivanti's patched releases (10.7.1, 10.6.2 or 10.5.2) immediately. The US cyber agency CISA set a federal deadline of 14 June 2026, which signals how urgent this is.

If your business uses Ivanti Sentry, treat this as a priority. We recommend patching without delay and reviewing the device for any signs of compromise. Get in touch with OzComm if you would like us to verify your exposure.

Sources: Help Net Security, CISA KEV Catalog.