Ivanti disclosed two critical-severity flaws in its Ivanti Sentry in-line gateway this week; within days, exposed instances were already backdoored.
Both CVE-2026-10520 and CVE-2026-10523 rate a critical severity CVSS score, rating at 10 and 9.9, respectively, but it is the former vulnerability that has analysts worried, and, it turns out, they were right to worry.
“On June 10, 2026, watchTowr published a technical analysis of CVE-2026-10520 that includes a proof-of-concept (PoC) exploit for unauthenticated RCE. Given the trivial nature of exploitation and the availability of a public PoC, exploitation in-the-wild is likely to begin,” cyber security firm Rapid7 said in a 10 June blog post.
“Ivanti Sentry has featured on the CISA KEV list twice in the past (for the vulnerabilities CVE-2023-38035 and CVE-2020-15505), so we know threat actors will likely target this product.”
And why is this one worrying? watchTowr lays out exactly why before diving into forensic detail about how the exploit works.
“Ivanti Sentry, formerly known as MobileIron Sentry, is an in-line gateway that manages, encrypts, and secures traffic between mobile devices and back-end enterprise systems. It usually sits between corporate mobile fleets and resources such as Microsoft Exchange, controlling ActiveSync email traffic and application data,” watchTowr said.
“Sentry works alongside Ivanti Endpoint Manager Mobile (EPMM) and enforces device-level access decisions, so only compliant, registered devices can reach internal services.”
Ivanti said in its initial advisory that it was “not aware of any customers being exploited by these vulnerabilities at the time of disclosure”. As of publishing, that’s all the company has said.
However, non-profit internet security firm Shadowserver is already tracking the first efforts at malicious exploitation.
“We are observing a large amount of Ivanti Sentry CVE-2026-10520 exploitation attempts based on the public PoC today,” Shadowserver said in a 10 June post to X.
“We see 19 vulnerable instances in our own scans, with at least 2 backdoored (thanks to @NCA_KSA for the tip!). However, all remaining likely compromised too.
“While our detection is on the lowish side due to multiple Ivanti Sentry instances not reachable in our scans (blocklisted?), if you have not patched now you are most likely compromised.”
The exploit impacts versions 10.5.1, 10.6.1, 10.7.0 and earlier of Ivanti Sentry, and the patched version is available via Ivanti’s Download Portal.
UPDATE 15/06/26
Ivanti has provided further comment to Cyber Daily regarding CVE-2026-10520
"Ivanti updated the Security Advisory for Sentry on Thursday, June 11, 2026 to reflect the practical risk of CVE-2026-10520. While this CVE carries a CVSS score of 10, the risk posed to customers is decreased significantly based on deployment and configuration.
For EPMM-managed Sentry appliances, the vulnerable APIs are protected by mTLS after management. It is not possible for an unmanaged Sentry to be used in production as the management is what pushes the configuration for device connectivity and authentication.
Ivanti Neurons for MDM managed Sentry appliances should not have the vulnerable API exposed to the internet as it is the management interface. This is clearly documented for both MDM and EPMM.
This CVE was added to the CISA KEV due to reports online that there has been attempted exploitation of honeypots. Successful exploitation requires access to the management port 8443 and this port should never be exposed to the internet. Honeypots often have misconfigurations to identify and track malicious behaviour.
Ivanti discovered this CVE with the use of advanced LLM which we have begun integrating into our product security processes. This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling. We expect that this work will result in an uptick in proactive security
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.