Ivanti has released patches for two critical vulnerabilities affecting its Sentry secure mobile gateway. The issues include CVE-2026-10520, described as a maximum-severity problem that can allow a remote attacker to execute code with root privileges, resulting in root-level compromise. Ivanti also fixes a second critical flaw, CVE-2026-10523. According to reporting from multiple outlets, Ivanti urges customers to apply the updates promptly.
While the vulnerabilities are not reported as being actively exploited in the wild, security researchers have already published technical details for at least one of the flaws (CVE-2026-10520). Those details may enable attackers to develop or refine a working exploit. The publications characterize Ivanti Sentry as a security gateway used to manage and protect mobile device connections outside of internal networks, positioning the product as a potential target for adversaries seeking unauthorized access.
Overall, the coverage focuses on the critical severity of both flaws, Ivanti’s mitigation through patched releases, and the risk that publicly available technical information could reduce barriers for exploitation.
