Ivanti Sentry Max Severity RCE + Auth Bypass (CVE-2026-10520 CVSS 10.0, CVE-2026-10523 CVSS 9.9)

Ivanti Sentry secure mobile gateways (formerly MobileIron Sentry) carry two maximum-severity flaws patched June 9: CVE-2026-10520 (CVSS 10.0) is an unauthenticated OS command injection giving root-level remote code execution through a crafted request, and CVE-2026-10523 (CVSS 9.9) is an authentication bypass allowing attackers to create rogue admin accounts. The same advisory covered high-severity EPMM bugs (CVE-2026-6973, CVE-2026-10727) enabling authenticated RCE via arbitrary Apache directives and root command execution, plus Fortinet patched CVE-2026-25089 (CVSS 9.8), an unauthenticated OS command injection in FortiSandbox WEB UI. No vendor advisory acknowledges active exploitation yet, but Shadowserver telemetry and CISA's KEV entry contradict that silence.

The distinction here is not the bug class but the speed and scale of confirmed exploitation. Shadowserver found 19 vulnerable Sentry instances in scans, with at least 2 already backdoored, and warned that unpatched systems are most likely compromised; attackers began backdooring exposed instances within 24 hours of the June 9 release, driven by a public PoC. Only about 50 Sentry admin portals remain visible to scanners because the rest are blocklisted, which means the real exposed population is larger and harder to assess. CISA added CVE-2026-10520 to KEV on Thursday under BOD 26-04, making it the first vulnerability covered by the new risk-based directive and requiring federal agencies to patch within three days. With 34 Ivanti CVEs already flagged as actively exploited, the combined chain of unauthenticated root RCE plus admin account creation on a mobile-access gateway is not a theoretical risk; it is a confirmed compromise vector for every reachable Sentry instance.

Rebuild any exposed Sentry instance from known-good firmware rather than trusting a patch alone, because Shadowserver's assessment implies active root-level persistence. Verify admin accounts for unauthorized creation tied to CVE-2026-10523, and restrict access to the admin portal at the network boundary. Hunt for exploitation attempts matching the public PoC and log anomalies associated with crafted requests targeting the Sentry gateway. Update EPMM installations and FortiSandbox systems as part of the same maintenance cycle, since the advisory bundles multiple root-level RCE paths across Ivanti's product line.

Watch for Ivanti updating its advisory to acknowledge active exploitation, which would confirm what Shadowserver and CISA already indicate. Monitor Shadowserver for updated scan counts beyond the 19 vulnerable and 2 backdoored instances reported, as additional exposure would shift the risk calculus for enterprises running blocklisted gateways.