Two critical vulnerabilities affecting Ivanti’s mobile gateway require immediate patching, with the worst allowing unauthenticated attackers to execute code with root privileges.
Summary
- CVE-2026-10520 scores perfect 10.0 CVSS, enabling remote code execution with root privileges without authentication
- CVE-2026-10523 rates 9.9 CVSS for authentication bypass allowing admin account creation
- No known active exploitation yet, but researchers have already begun analysing the patches
- Patches available in versions 10.5.2, 10.6.2, and 10.7.1
Ivanti has disclosed two critical vulnerabilities in its Sentry mobile gateway platform that demand immediate attention from security teams. The more severe flaw, CVE-2026-10520, achieves the maximum possible CVSS score of 10.0 and allows remote, unauthenticated attackers to execute code with root privileges on affected systems.
Root Access Without Authentication
The perfect-10 vulnerability represents one of the worst possible security scenarios: remote code execution without any authentication requirements. According to security researchers at watchTowr, the flaw stems from an exposed API running under Apache Tomcat that processes specially crafted messages as MICS configuration commands, executing them with root privileges.
Ivanti addressed this vulnerability by blocking the acceptance of attacker-supplied strings, replacing them with a single hard-coded command. The vendor also updated Apache configuration rules to prevent unauthenticated access to the affected endpoint.
Administrative Bypass Adds to Risk
The second vulnerability, CVE-2026-10523, scores 9.9 on the CVSS scale and allows unauthenticated attackers to bypass authentication mechanisms and create administrative accounts. This grants attackers top-level privileges on compromised systems, creating a significant privilege escalation pathway.
Exploitation Timeline Concerns
While Ivanti reports no known active exploitation of either vulnerability, public disclosure typically accelerates attacker interest and capability development. Security researchers have already begun analysing the patches, potentially providing attackers with reverse-engineering insights for targeting unpatched systems.
This disclosure follows Ivanti’s January remediation of two separate critical vulnerabilities in its Endpoint Manager Mobile platform, both scoring 9.8 CVSS ratings. Those flaws were actively exploited as zero-day attacks, with notable victims including the Dutch data protection authority, which reported the breach to parliament.
Why it matters
These vulnerabilities present catastrophic risk exposure for organisations running Ivanti Sentry, with the 10.0-rated flaw offering attackers the worst-case scenario of unauthenticated remote root access. Combined with Ivanti’s recent history of zero-day exploitation, this creates urgent patching requirements to prevent potential compromise of mobile gateway infrastructure.
What to do now
- Upgrade Ivanti Sentry to versions 10.5.2, 10.6.2, or 10.7.1 immediately
- Prioritise patching given the maximum severity rating and potential for rapid exploitation development
- Monitor for signs of compromise on unpatched systems while deployment occurs
