Ivanti Sentry CVE‑2026‑10520 exploited within 24 hours

Threat actors began exploiting a critical vulnerability in Ivanti's Sentry security gateway within 24 hours of its public disclosure, according to cybersecurity researchers. The flaw, tracked as CVE-2026-10520, carries the maximum severity rating of 10 and allows unauthenticated attackers to remotely execute code with root-level privileges on vulnerable appliances.

Ivanti disclosed the vulnerability, along with a second authentication bypass flaw tracked as CVE-2026-10523, in a security advisory on Tuesday, June 9. The company stated at the time that it was not aware of any active exploitation. However, the situation changed rapidly after cybersecurity firm WatchTowr published a technical analysis and a proof-of-concept exploit for CVE-2026-10520. Researchers at Rapid7 warned that the flaw was easy to weaponize and urged immediate patching.

Exploitation attempts began almost immediately. The Shadowserver Foundation reported observing a large number of exploitation attempts based on the public proof-of-concept on Wednesday, June 10. Its scans identified at least 19 vulnerable Ivanti Sentry instances on the internet, with at least two of those systems confirmed to be backdoored....