CVE-2026-10520 / CVE-2026-10523 — Ivanti Sentry: pre-auth command injection to root, now confirmed exploited and gateways backdoored

If you did nothing this week: any internet-facing Ivanti Sentry gateway you run is likely already compromised. The flaw moved from "advisory plus public PoC" on 10 June to confirmed in-the-wild exploitation with persistent implants by 14 June.

CVE-2026-10520 (CVSS 10.0) is an unauthenticated OS command injection in the MICS (Mobile Iron Configuration Service) administrative interface of Ivanti Sentry — the EMM/MDM enforcement gateway that proxies email and applications to managed mobile devices and is frequently exposed to the internet. watchTowr Labs published the technical analysis and a working proof-of-concept on 10 June (watchTowr Labs; daily 06-10), and a paired path (CVE-2026-10523) compounds the exposure. By 14 June SecurityAffairs and others reported that gateways were being compromised shortly after patch release, with attacker-established footholds on exposed systems (daily 06-14, SecurityAffairs).

Because the injection is pre-auth and on the management interface, the only safe assumption for an exposed, unpatched Sentry is that it has been touched. Patch to the fixed Sentry release immediately, then treat the appliance as suspect: review for unexpected child processes spawned by the Sentry service account, unexplained outbound connections, and modified web-tier files. Restrict the MICS interface to management networks — it should never have been internet-reachable.