Threat actors are exploiting a newly addressed maximum-severity issue in Ivanti Sentry to run arbitrary code with root rights on publicly reachable mobile security gateways.

Previously called MobileIron Sentry, the Ivanti Sentry appliance protects communications between internal corporate resources and remote mobile endpoints.

Assigned CVE-2026-10520, the critical flaw arises from an operating-system command-injection problem and received fixes on Tuesday via Sentry releases R10.5.2, R10.6.2, and R10.7.1.

Although Ivanti initially reported no signs of active exploitation, the Shadowserver nonprofit disclosed the following day that most online-exposed Sentry appliances had already been implanted with backdoors.

The watchdog noted that its scans reveal only a modest count of reachable instances, yet additional devices may exist because its crawler faces blocklisting.

"We are observing a large amount of Ivanti Sentry CVE-2026-10520 exploitation attempts based on the public PoC today. We see 19 vulnerable instances in our own scans, with at least 2 backdoored (thanks to Saudi NCA for the tip!). However, all remaining likely compromised too," Shadowserver warned.

"While our detection is on the lowish side due to multiple Ivanti Sentry instances not reachable in our scans (blocklisted?), if you have not patched now you are most likely compromised."

Ivanti has not yet revised its Tuesday advisory, which continues to state that the firm remains unaware of customer compromises at disclosure time.

An Ivanti spokesperson could not be reached immediately for additional comment on the ongoing campaign.

Attackers frequently focus on Ivanti security weaknesses because they offer direct pathways into enterprise networks and the sensitive data they hold.

For example, several Ivanti zero-day flaws have been leveraged in recent years against diverse targets, including government entities worldwide, such as two critical Endpoint Manager Mobile vulnerabilities fixed in January after limited customer impact.

More recently, the Cybersecurity and Infrastructure Security Agency directed federal agencies last month to remediate Ivanti systems following disclosure of a high-severity remote-code-execution flaw in Endpoint Manager Mobile that had been exploited as a zero-day.

Over recent years CISA has identified 34 actively exploited Ivanti vulnerabilities, twelve of which also featured in ransomware operations.

Ivanti maintains more than 7,000 partners and over 3,000 employees, with its asset-management offerings deployed at more than 40,000 organizations globally.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper