Ivanti Sentry gateways compromised by CVE-2026-10520 injection bug

Attackers are exploiting a critical OS command injection vulnerability, CVE-2026-10520, in Ivanti Sentry, which allows remote code execution with root privileges. Despite initial claims of no active exploitation, security researchers from Shadowserver reported multiple compromised Ivanti Sentry gateways shortly after patches were released. This vulnerability is significant as Ivanti Sentry serves as a gateway between corporate systems and mobile devices, putting businesses at risk if compromised.

Ivanti has yet to update their advisory regarding active exploitation, but given the nature of the vulnerability, prompt patching is strongly advised to secure enterprise networks.