2026-008: Critical vulnerabilities in Ivanti Sentry

Ivanti Sentry (formerly MobileIron Sentry) contains an OS command injection flaw (CWE-78) that lets a remote, unauthenticated attacker execute operating-system commands with root privileges on the appliance. Exploitation succeeds when the Sentry appliance is in an unmanaged state with its endpoints externally reachable; deployments that enforce mTLS with EPMM or restrict HTTPS access through Ivanti Neurons for MDM keep the interfaces inaccessible to external actors. A successful attacker gains root-level remote code execution, giving full control of the gateway that fronts an organization's mobile device management (MDM) infrastructure. Organizations running unmanaged, internet-exposed Ivanti/MobileIron Sentry appliances are affected. The flaw is being exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-11 (formal CVSS scoring is still pending), EPSS puts the 30-day exploitation probability at 99.9%, no public proof-of-concept is known, and ransomware use is undetermined.

Do: Inventory all Ivanti/MobileIron Sentry appliances and determine whether they are unmanaged with externally reachable endpoints; apply Ivanti's mitigations in line with CISA KEV and BOD 26-04 timelines, and where a patch is not yet in place, restrict access by enabling mTLS with EPMM or limiting HTTPS access through Ivanti Neurons for MDM. Monitor Ivanti's advisories for fixed versions and review exposed appliances for signs of compromise.

CVE-2026-10523 is an authentication bypass (CWE-288) in Ivanti Sentry, the gateway component formerly known as MobileIron Sentry, affecting standalone deployments before the R10.5.2, R10.6.2, and R10.7.1 releases. A remote, unauthenticated attacker can exploit it over the network with no credentials, no user interaction, and no special conditions, creating arbitrary administrative accounts on the affected gateway. The attacker thereby obtains full administrative control of Sentry, which in most deployments sits at the network edge handling mobile-device (MDM/UEM) traffic for organizations using Ivanti's mobility management stack. Any organization running an affected standalone Sentry version is exposed, with internet-facing instances at greatest risk. Exploitation has not yet been confirmed in the wild (no public PoC, not in CISA KEV), but the high EPSS score of 51.9% (99th percentile) indicates a strong likelihood of exploitation within the next 30 days.

Do: Upgrade standalone Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 depending on your current release branch. Until patched, restrict network exposure of Sentry (especially direct internet access) and review the administrative account list for unexpected admin accounts created without authorization. Given the critical severity and high EPSS, prioritize patching internet-facing instances first.