OS command injection in Ivanti Sentry (CVE-2026-10520) — unauthenticated root-level remote control

1Ivanti Sentry as management infrastructure

CVE-2026-10520 is an OS command injection vulnerability (CWE-78) in Ivanti Sentry (formerly MobileIron Sentry). Sentry is a gateway product that sits between mobile devices (smartphones, etc.) and internal mail/app systems, relaying traffic and handling authentication.

2The unmanaged state

Per public information, when the Sentry appliance is in an unmanaged state, a remote, unauthenticated attacker can achieve root-level remote code execution (RCE). OS command injection is a flaw where input that should be treated as data is instead interpreted and executed as an OS command inside the device; when it succeeds, the device itself can be taken over.

3Why edge devices are dangerous

This class of device is dangerous because (1) it sits at the boundary between the internet and the internal network and is reachable from outside, and (2) as the linchpin connecting mobile devices and internal systems, its compromise becomes a foothold for internal intrusion. The flaw needs no authentication and has low complexity, with impact extending beyond the device itself.

4Being unmanaged is the condition

The condition given for this vulnerability is that the Sentry appliance is in an unmanaged state. Whether it is managed is itself the line between safe and not.

Sentry is a gateway product standing between mobile devices such as smartphones and internal mail and application platforms, relaying traffic and handling authentication. It sits at the boundary, reachable from outside, and a breach makes it a foothold into the internal network. Alongside applying the fix, checking the device's managed state and its external exposure is the point of the response.