Summary
CISA has added CVE-2026-10520 — a maximum-severity (CVSS 10.0) OS command injection vulnerability in Ivanti Sentry — to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by June 15, 2026. The flaw allows unauthenticated remote attackers to achieve root-level code execution on affected appliances.
Ivanti released patches on June 9, initially stating there was no evidence of in-the-wild exploitation. That changed within 24 hours after security researchers published a proof-of-concept exploit, and threat actors rapidly weaponized it. Affected versions include Ivanti Sentry 10.5.1, 10.6.1, and 10.7.0, with fixes available in 10.5.2, 10.6.2, and 10.7.1.
A second critical vulnerability — an authentication bypass tracked as CVE-2026-10523 — was also patched in the same release cycle. Organizations running Ivanti Sentry are urged to update immediately.
Source
CISA Advisory · Dark Reading · Rapid7
Commentary
Ivanti continues to be a magnet for critical vulnerabilities. This marks yet another CVSS 10.0 in their product line, and the speed of exploitation — within 24 hours of PoC release — underscores how compressed the attacker response window has become. Organizations simply cannot afford multi-day patch cycles for internet-facing appliances anymore.
The 3-day CISA deadline (patch by Sunday) tells you everything about the severity. If you’re running Ivanti Sentry and haven’t patched by the time you’re reading this, assume compromise and start incident response.