CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch Release

Ivanti Sentry (formerly MobileIron Sentry) contains an OS command injection flaw (CWE-78) that lets a remote, unauthenticated attacker execute operating-system commands with root privileges on the appliance. Exploitation succeeds when the Sentry appliance is in an unmanaged state with its endpoints externally reachable; deployments that enforce mTLS with EPMM or restrict HTTPS access through Ivanti Neurons for MDM keep the interfaces inaccessible to external actors. A successful attacker gains root-level remote code execution, giving full control of the gateway that fronts an organization's mobile device management (MDM) infrastructure. Organizations running unmanaged, internet-exposed Ivanti/MobileIron Sentry appliances are affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-11 (formal CVSS scoring is still pending), EPSS puts the 30-day exploitation probability at 99.9%, no public proof-of-concept is known, and ransomware use is undetermined.

Do: Inventory all Ivanti/MobileIron Sentry appliances and determine whether they are unmanaged with externally reachable endpoints; apply Ivanti's mitigations in line with CISA KEV and BOD 26-04 timelines, and where a patch is not yet in place, restrict access by enabling mTLS with EPMM or limiting HTTPS access through Ivanti Neurons for MDM. Monitor Ivanti's advisories for fixed versions and review exposed appliances for signs of compromise.

CVE-2026-1340 is a code injection flaw (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM), Ivanti's enterprise mobile device management platform, that permits unauthenticated remote code execution. Because the flaw is network-reachable and requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), a remote attacker can send a crafted request to a vulnerable EPMM server and execute arbitrary code, with high impact to confidentiality, integrity, and availability. Any organization operating an affected EPMM server is affected, especially those exposing the management or device-enrollment interface to the internet. The flaw was added to CISA's KEV catalog on 2026-04-08 with an 86.2% probability of exploitation within 30 days; news reporting describes active zero-day attacks against EPMM (alongside related CVE-2026-6973), including a confirmed Dutch government incident exposing employee contact data, while ransomware use remains unconfirmed. A large share of observed exploit traffic has been traced to a single IP address on bulletproof hosting infrastructure.

Do: Apply Ivanti's patched EPMM release per the vendor advisory immediately and verify the fix on any internet-facing EPMM portal; US federal agencies must follow BOD 22-01 mitigation deadlines. Until patched, restrict EPMM portal access to trusted networks/VPNs and review access logs for suspicious requests or unrecognized source IPs, noting that much exploit activity has originated from a single bulletproof-hosting IP.

CVE-2026-1603 is an authentication bypass (CWE-288/CWE-306) in Ivanti Endpoint Manager (EPM) that affects versions before 2024 SU5. A remote, unauthenticated attacker can send crafted network requests to a vulnerable EPM core server without valid credentials. Successful exploitation grants read access to specific stored credential data held by EPM, which could be leveraged for further access within the environment. Any organization running an EPM deployment on a version earlier than 2024 SU5 is exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-09, confirming active exploitation in the wild, and its EPSS score of 80.6% (100th percentile) indicates a very high likelihood of exploitation in the next 30 days; no public proof-of-concept is known, suggesting private exploit use.

Do: Upgrade EPM core servers to version 2024 SU5 (or later) as soon as possible, in line with CISA's KEV and BOD 22-01 timelines, which have been shortened for this flaw. Until patched, restrict internet-facing exposure of EPM services and review EPM servers for anomalous authentication activity or signs of stored-credential access. If mitigations are unavailable, follow CISA's guidance to apply vendor-recommended mitigations or discontinue use of the affected product.