Loading story…
A critical Ivanti Sentry vulnerability, CVE-2026-10520, is being actively exploited to achieve unauthenticated remote code execution with root privileges through OS command injection. The flaw stems from improper handling of internal configuration commands exposed through an externally accessible API, allowing full compromise of affected appliances. CISA added the bug to its Known Exploited Vulnerabilities catalog, and FortiGuard reported 886 blocked exploitation attempts in 24 hours and 8,406 over seven days, with activity rising 82% week over week across the technology, automotive, banking/finance/insurance, and education sectors.
The vulnerability affects Ivanti Sentry versions before 10.5.2, 10.6.2, and 10.7.1, and Ivanti has released those versions as fixes. Because Sentry operates as an inline gateway between mobile devices and enterprise back-end systems, successful exploitation can expose a critical network chokepoint and enable broad downstream access. Ivanti also addressed CVE-2026-10523 in the same update, though it was not reported as exploited, and defenders are being urged to upgrade immediately and restrict management and service interfaces from untrusted networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard said it blocked 886 exploitation attempts in the prior 24 hours and 8,406 in the prior 7 days for CVE-2026-10520, with weekly activity up 82%. It also noted targeting across the technology, automotive, banking/finance/insurance, and education sectors.
CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalog after active exploitation was observed. This formally marked the Ivanti Sentry flaw as exploited in the wild.
Ivanti released patched Ivanti Sentry versions 10.5.2, 10.6.2, and 10.7.1 to address the critical OS command injection flaw CVE-2026-10520; the same update also included CVE-2026-10523. The vulnerability affects earlier Sentry versions and can allow unauthenticated root-level command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti disclosed two severe vulnerabilities in **Ivanti Sentry** that allow remote compromise of exposed appliances. **`CVE-2026-10520`** is an OS command injection flaw (`CWE-78`) that can let an unauthenticated attacker achieve **root-level remote code execution**, while **`CVE-2026-10523`** is an authentication bypass (`CWE-288`) that can be used to create arbitrary administrative accounts and obtain full administrative access. Both issues affect Ivanti Sentry versions earlier than **R10.5.2**, **R10.6.2**, and **R10.7.1**. The vulnerabilities carry severe impact ratings, with `CVE-2026-10520` described as critical and `CVE-2026-10523` as high severity, reflecting risks to confidentiality, integrity, and availability. Ivanti said the flaws were addressed in **R10.5.2**, **R10.6.2**, and **R10.7.1**, and published a security advisory covering both CVEs, making patching of affected Sentry deployments an immediate priority.
Jul 3, 2026
Ivanti released fixes for a newly disclosed high-severity flaw in its on-premises Endpoint Manager Mobile (**EPMM**) platform, tracked as `CVE-2026-6973`, after confirming limited zero-day exploitation. The vulnerability is caused by improper input validation and can lead to arbitrary code execution when a remote attacker already has administrator-level access. Ivanti said the issue affects EPMM `12.8.0.0` and earlier and issued patched versions `12.6.1.1`, `12.7.0.1`, and `12.8.0.1`, while urging customers to review privileged accounts and rotate credentials. The disclosure adds to a longer pattern of Ivanti security incidents: CISA previously warned that `CVE-2023-35082`, a critical authentication bypass flaw in Ivanti EPMM and MobileIron Core, was being actively exploited to gain unauthenticated API access, expose user data, and potentially backdoor servers when chained with other vulnerabilities. ConnectWise also disclosed a critical vulnerability in **ConnectWise Automate**, tracked as `CVE-2026-9089`, affecting versions prior to `2026.5`. The flaw, classified as `CWE-494`, stems from insufficient integrity verification during plugin loading and self-update operations and could allow malicious code execution on client machines during agent updates under specific network conditions. ConnectWise assigned the issue a CVSS score of **8.8**, automatically updated cloud deployments, and instructed on-premises customers to manually upgrade to version `2026.5`; Canada’s Cyber Centre separately urged administrators to apply the vendor update. The disclosures highlight continued risk across widely deployed enterprise management platforms, with internet exposure data showing hundreds of Ivanti EPMM systems and broad operational dependence on remote monitoring and mobile device management software.
Jun 29, 2026
Ivanti Endpoint Manager has been found to contain a total of 13 security vulnerabilities, including high-severity remote code execution (RCE) and 11 SQL injection flaws. Security researchers disclosed that these vulnerabilities could allow attackers to compromise systems managed by Ivanti Endpoint Manager, a widely used enterprise IT management solution. Among the most critical issues is CVE-2025-9713, which enables remote, unauthenticated attackers to achieve code execution through a path traversal flaw, provided user interaction occurs. The CVSS score for this vulnerability is 8.8, indicating a high risk to organizations using affected versions. The vulnerabilities were publicly disclosed in mid-October 2025, prompting urgent attention from security teams. The SQL injection vulnerabilities could allow attackers to manipulate backend databases, potentially leading to data exfiltration or further compromise of the management infrastructure. The RCE flaw, in particular, poses a significant threat as it could be exploited remotely, increasing the attack surface for threat actors. Ivanti has not yet published a comprehensive list of affected product versions, but the risk profile suggests that a broad range of deployments may be impacted. Security advisories recommend immediate review of Ivanti Endpoint Manager deployments and the application of any available patches or mitigations. Organizations are urged to monitor for signs of exploitation and to implement network segmentation to limit potential lateral movement. The vulnerabilities highlight the ongoing risks associated with enterprise management platforms, which often have elevated privileges across corporate environments. No reports of active exploitation have been confirmed at the time of disclosure, but the technical details suggest that exploitation would be feasible for skilled attackers. The disclosure underscores the importance of timely vulnerability management and the need for robust monitoring of critical IT infrastructure. Security teams should prioritize patching and consider additional controls such as application whitelisting and enhanced logging. The incident serves as a reminder of the potential impact of vulnerabilities in widely deployed enterprise software. Given the severity and nature of the flaws, organizations should treat this as a high-priority security event. The situation remains dynamic as further technical details and remediation guidance are expected from Ivanti and the security community.
Jun 29, 2026