Ivanti Sentry RCE: Publicly Disclosed PoC for CVSS 10

Critical Ivanti gateway vulnerabilities were disclosed: an unauthenticated root-level OS command injection (CVE-2026-10520, CVSS 10) and an authentication bypass allowing arbitrary admin account creation (CVE-2026-10523, CVSS 9.9). Public PoC code and analysis are available, vendors released urgent patches (10.5.2, 10.6.2, 10.7.1), and organizations are advised to apply updates and audit telemetry immediately; no in-the-wild exploitation was reported at disclosure.