What happened
In June 2026, Ivanti fixed CVE-2026-10520, a maximum-severity (CVSS 10) OS command injection in Ivanti Sentry, the security gateway formerly known as MobileIron Sentry. Fixed versions: R10.5.2, R10.6.2 and R10.7.1.
When it shipped the patch, Ivanti said it had no evidence of exploitation. The next day, Shadowserver reported many exploitation attempts based on a public PoC and said many exposed gateways had already been backdoored. Its warning was blunt: "if you have not patched now you are most likely compromised."
On Thursday (June 11), CISA added the flaw to its KEV catalog and gave federal agencies three days to fix it. It was the first flaw handled under the new BOD 26-04, a directive issued the day before that replaces BOD 19-02 and 22-01 and prioritizes flaws that are internet-exposed, exploited, automatable and give control of the system.
The other side
Ivanti told BleepingComputer that CISA acted on attempts against honeypots and that real risk is much lower, because exploitation requires access to management port 8443, which should never be exposed to the internet. Shadowserver counted just over 50 exposed Sentry admin portals, but warned the real number may be higher.
What to do
- Update to R10.5.2, R10.6.2 or R10.7.1.
- Close port 8443 to the internet. The admin panel should only be reachable from the internal network or VPN.
- If Sentry was exposed and unpatched, treat it as compromised: investigate, rotate credentials and consider rebuilding.
- If you run Check Point firewalls, there is an IPS protection for this CVE (CPAI-2026-6697).
Context
According to BleepingComputer, CISA has flagged 35 Ivanti flaws exploited in attacks, 12 of them by ransomware gangs. Edge devices remain the favorite target.
Sources
- BleepingComputer (2026-06-12, updated 2026-06-15): https://www.bleepingcomputer.com/news/security/cisa-gives-feds-3-days-to-patch-ivanti-flaw-exploited-in-attacks/
- Check Point, IPS protection CPAI-2026-6697: https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-6697.html/
Does your company have admin panels exposed to the internet? KGA IT offers a free check: kga-it.com.