A perfect score means no assumptions have to hold
Ivanti disclosed CVE-2026-10520 on June 9, a CVSS 10.0 OS command injection in Ivanti Sentry, the appliance that brokers access between mobile devices and back-end systems such as email and content repositories. A perfect score is rare because it requires every dimension to fall the attacker's way: network reachable, no authentication, no user interaction, and full impact to confidentiality, integrity, and availability. This flaw checks all of them. An unauthenticated attacker who can reach the appliance runs arbitrary commands as root.
The vulnerability lives in the ConfigServiceController class and is reachable through an unauthenticated HTTP POST to the /mics/api/v2/sentry/mics-config/handleMessage endpoint. Sentry sits at the edge by design, standing between untrusted mobile clients and trusted internal services, which is exactly the position that makes a pre-auth root RCE so dangerous. Compromise the gateway and you own the trust boundary it was built to enforce, with a clear line of sight into the systems behind it.
The gap between advisory and exploit was one day
The timeline is the part that should reset your patch calculus. Ivanti published its advisory on June 9. On June 10, the research team at watchTowr released a technical analysis with a working proof-of-concept. On June 11, CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, triggering the three-day federal remediation clock under Binding Operational Directive 26-04. Advisory to public exploit to KEV listing took roughly 48 hours, which is faster than most enterprise change-management windows can move.
That compression is the recurring story with edge appliances, and it removes the comfort of a staged rollout. When a max-severity pre-auth flaw in an internet-facing gateway gets a public exploit inside a day, the window between disclosure and mass scanning closes before a monthly maintenance cycle even opens. Treating this class of device on the same patch cadence as an internal application server is a losing bet, because the attacker's tooling is ready before your change ticket clears review.
There are two critical bugs, and the second one persists
CVE-2026-10520 shipped alongside CVE-2026-10523, a CVSS 9.9 authentication bypass that lets a remote unauthenticated attacker create arbitrary administrative accounts on the same appliance. The command injection gets the headlines because a perfect score demands attention, but the authentication bypass is arguably the more durable threat. Code execution is a moment in time. A rogue admin account is persistence that survives a reboot and often survives the patch itself, sitting quietly until someone thinks to look for it.
That distinction should shape your response. Patching to a fixed build closes the injection path, but it does nothing about an administrative account an attacker created before you patched. Any Sentry appliance that was internet-reachable between June 9 and the day you remediated needs an account audit, not just a version bump. The two flaws together turn a single unauthenticated request into both instant control and a standing backdoor, which is why version number alone is a weak measure of whether you are clean.
Exploitation is real, and some appliances are already backdoored
Ivanti has said the exploitation attempts it observed targeted honeypots rather than confirmed production systems, and it stressed that reaching the flaw requires access to management port 8443, which the company says should never be exposed to the internet. That is accurate and also cold comfort, because plenty of Sentry deployments do expose that interface, whether through misconfiguration, legacy architecture, or an unmanaged appliance outside the EPMM management path that lacks the mutual-TLS protection managed instances get.
The Shadowserver Foundation put numbers to the exposure, identifying vulnerable instances in its scans and confirming that at least some had already been backdoored. That single detail should govern your triage. If you ran an internet-facing Sentry appliance during the exposure window, patching is necessary but insufficient. Assume compromise until you have inspected the box for unauthorized admin accounts, unexpected processes, and modified configuration, then rebuild rather than clean if you find anything you cannot fully explain.
Fixed versions and the containment that has to go with them
The remediation is straightforward on paper. Upgrade Ivanti Sentry to 10.7.1, 10.6.2, or 10.5.2 or later, which close both CVE-2026-10520 and CVE-2026-10523. Any release at 10.7.0, 10.6.1, or 10.5.1 and below remains vulnerable, so the first task is an accurate inventory of what you actually run and where each instance sits on the network. Alongside the upgrade, pull management port 8443 off the public internet, restrict it to a management network or VPN, and confirm that unmanaged appliances outside the EPMM management path are either brought under management, where mutual TLS protects the endpoint, or firewalled hard from untrusted networks.
Wrap the patch in verification rather than treating the version bump as the finish line. Review administrative accounts against a known-good baseline, hunt for the injection signature in web logs on the affected endpoint, and rotate credentials and secrets that a root-level foothold could have exposed. The appliances that broker your mobile access are load-bearing infrastructure, and a compromised Sentry is a pivot point into email and content systems, so the cost of assuming a clean patch when you were actually breached is measured in lateral movement you did not detect.
The pattern is bigger than one appliance
CVE-2026-10520 is one more entry in a run of pre-auth, maximum-severity flaws in the security and access appliances that sit at the network edge. The same story has played out this year across VPN gateways, load balancers, and sandbox appliances: a critical unauthenticated bug, a public exploit within days, active scanning, and a KEV listing before most defenders have finished reading the advisory. The devices sold to enforce your perimeter keep turning into the softest way through it.
The strategic response is to treat edge appliances as their own tier with their own rules. Give them an aggressive KEV-driven patch SLA measured in days, keep management planes off the public internet without exception, and put them under continuous external attack-surface monitoring so a drift into exposure gets caught before an attacker catalogs it. Ivanti Sentry is this month's example. The category is the actual problem, and the operators who plan around the category stop being surprised by each individual instance.
