Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9

Max-Severity Ivanti Sentry Flaw Exploited Within 24 Hours

CVE-2026-10520 (CVSS 10) in Ivanti Sentry enables unauthenticated RCE with root, exploited within 24h of PoC release. The gateway appliance controls enterprise device access; compromised credentials enable lateral movement. Sophisticated threat actors had Ivanti's landscape pre-mapped.