Critical Ivanti Sentry Flaws Enable Root Access and Admin Account Creation

Ivanti's Sentry mobile gateway contains two critical vulnerabilities that could allow attackers to completely compromise the system. CVE-2026-10520 enables remote code execution with root privileges through OS command injection, while CVE-2026-10523 allows bypassing authentication to create unauthorized administrative accounts. These flaws highlight the severe risks posed by unpatched network appliances and inadequate access controls in critical infrastructure. Organizations using Ivanti Sentry face potential complete system compromise until patches are applied.

Tactical Insight

Immediate actions

Apply Ivanti patches immediately for CVE-2026-10520 and CVE-2026-10523
Implement network restrictions to limit access to Sentry gateways from untrusted networks
Review and audit all administrative accounts for unauthorized access

Long-term improvements

Establish automated patch management processes for all network appliances
Implement multi-factor authentication for all administrative functions
Deploy network segmentation to isolate mobile gateway infrastructure

Detection measures

Enable comprehensive logging for authentication attempts and command execution
Monitor for unusual administrative account creation or privilege escalation activities