Advisories
Dual Critical Flaws in Ivanti Sentry Enable Unauthenticated RCE and Admin Account Creation
CERT‑EU has exposed two zero‑day weaknesses in Ivanti Sentry appliances. CVE‑2026‑10520 is an OS command injection that can be leveraged for root‑level remote code execution, while CVE‑2026‑10523 allows attackers to bypass authentication and create arbitrary administrative accounts. All Sentry releases up to 10.7.0 are affected. Immediate patching is required to avoid exploitation.
On June 9 2026, CERT‑EU released a security advisory detailing two critical vulnerabilities in Ivanti Sentry appliances that grant attackers unauthenticated remote code execution and full administrative control.
What the Vulnerabilities Do
- CVE‑2026‑10520 – OS command injection (CVSS 10.0) that lets a remote attacker run arbitrary commands with root privileges.
- CVE‑2026‑10523 – Authentication bypass (CVSS 9.9) enabling creation of new administrative accounts and complete device takeover.
Affected Versions
- Ivanti Sentry 10.5.1 and earlier
- Ivanti Sentry 10.6.1 and earlier
- Ivanti Sentry 10.7.0 and earlier
Mitigation
Update to a patched version immediately. No work‑arounds are available; the only safe path is to apply the vendor’s fix.
Takeaway
These flaws expose every Sentry appliance to a full compromise without any authentication. If you run any of the affected versions, patching should be your top priority.
Related articles
Check Point Urges Immediate Patch for Dual 9.8‑Score Vulnerabilities
On September 9 2026, Check Point issued emergency updates for its Security Gateway, Security Management Server, and Spark Firewall. Two critical flaws—both rated 9.8 on CVSS—enable unauthenticated remote code execution on devices running Remote Access or Site‑to‑Site VPN. CERT‑EU urges rapid deployment of the hotfixes, focusing first on internet‑facing and perimeter appliances.
Read briefing
Ivanti Connect Secure & Policy Secure Gateways Hit by Multi‑Vulnerability Surge – Patch Now
A wave of critical flaws—CVE‑2024‑22024, CVE‑2024‑21888, CVE‑2024‑21893, CVE‑2023‑46805, CVE‑2024‑21887—has been actively exploited against Ivanti Connect Secure and Policy Secure Gateways. The bugs enable unauthenticated privilege escalation, SSRF, and remote code execution, letting attackers hijack devices and steal credentials. Ivanti released patches for most affected versions in February, with additional fixes rolled out through March. Immediate patching, re‑authentication, and hardened configuration are essential to stop attackers from leveraging these weaknesses.
Read briefing
Critical Windows Netlogon RCE Exploited in Wild – Immediate Patch Required
Microsoft’s latest advisory reveals CVE‑2026‑41089, a stack‑based buffer overflow in Netlogon that lets unauthenticated attackers run code with SYSTEM privileges on domain controllers. The flaw is already being leveraged in the field, affecting a wide range of Windows Server releases from 2012 to 2025. Rapid patching of all vulnerable servers is essential to stop attackers from hijacking domain infrastructure.
Read briefing
Cisco Secure Email Gateway & AsyncOS: Multi‑Vulnerability Alert – RCE, DoS, SQLi
A wave of security flaws has been uncovered across Cisco’s Secure Email Gateway, Secure Email and Web Manager, and AsyncOS platforms. Several of the bugs enable attackers to execute arbitrary code remotely, crash the system, and inject malicious SQL statements. Cisco’s CVE‑2026‑76461 is already being actively exploited. Immediate patching is mandatory for all affected versions, and network operators should verify that hardening guidelines are in place.
Read briefing