OS command injection in Ivanti Sentry (CVE-2026-10520) — unauthenticated root-level remote control

CVE-2026-10520 is an OS command injection vulnerability (CWE-78) in Ivanti Sentry (formerly MobileIron Sentry). Sentry is a gateway product that sits between mobile devices (smartphones, etc.) and internal mail/app systems, relaying traffic and handling authentication.

Per public information, when the Sentry appliance is in an unmanaged state, a remote, unauthenticated attacker can achieve root-level remote code execution (RCE). OS command injection is a flaw where input that should be treated as data is instead interpreted and executed as an OS command inside the device; when it succeeds, the device itself can be taken over.

This class of device is dangerous because (1) it sits at the boundary between the internet and the internal network and is reachable from outside, and (2) as the linchpin connecting mobile devices and internal systems, its compromise becomes a foothold for internal intrusion. The flaw needs no authentication and has low complexity, with impact extending beyond the device itself.

Key response: check Ivanti's official advisory, identify affected versions, and apply the provided fixes/mitigations. CISA required U.S. federal civilian agencies to remediate by June 14, 2026 (a practical benchmark for others), and because this is a perimeter device the earliest possible action is advisable. Also review each appliance's managed/unmanaged state and external exposure, and check logs for suspicious access.