#ivanti Tech News.

Attackers are actively exploiting a critical-severity OS command injection vulnerability in Ivanti Sentry. The flaw allows arbitrary code execution with root privileges. Honeypots are detecting exploitation attempts, indicating active threat campaigns targeting the product.

CISA ordered federal agencies to patch an actively exploited Ivanti Sentry flaw, CVE-2026-10520, within three days under BOD 26-04. The maximum-severity OS command injection vulnerability is under active attack, with Shadowserver warning that unpatched systems are likely compromised.

Attackers are exploiting a maximum-severity OS command injection vulnerability, CVE-2026-10520, in Ivanti Sentry gateways to execute code with root privileges. Ivanti patched the flaw on Tuesday, but Shadowserver reported the next day that most exposed instances were already backdoored. Ivanti has not updated its advisory stating no known exploitation.

Fortinet patched a command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI tracked as CVE-2026-25089 with a CVSS score of 9.1. Ivanti fixed two critical flaws in Ivanti Sentry that allowed unauthenticated attackers to execute commands via crafted HTTP requests.

Ivanti disclosed two critical vulnerabilities in Sentry, a mobile gateway. CVE-2026-10520 carries a 10.0 severity, allowing remote unauthenticated root-level code execution. CVE-2026-10523 is a 9.9 authentication bypass enabling admin account creation. Customers should upgrade to versions 10.5.2 or 10.6.2 immediately.

Fortinet and Ivanti patched two OS command injection vulnerabilities that allow remote, unauthenticated attackers to execute arbitrary code. The flaws pose a severe risk to unpatched systems. Administrators should apply updates immediately to prevent exploitation.

Ivanti patched two critical Sentry vulnerabilities, including CVE-2026-10520, a maximum-severity OS command injection flaw allowing remote root code execution. The second flaw, CVE-2026-10523, is an authentication bypass enabling unauthenticated attackers to create rogue admin accounts. Ivanti released fixes in versions R10.5.2, R10.6.2, and R10.7.1, with no evidence of exploitation in the wild.