Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure

Ivanti disclosed a critical OS command injection vulnerability (CVE-2026-10520, CVSS 10) in its Sentry gateway; a public PoC quickly appeared and threat actors began exploiting it within 24 hours, with multiple instances observed being probed and at least two backdoored. Security vendors and observers reported widespread, automated exploitation including direct attacks on honeypots, and warned that compromise of Sentry appliances can expose credentials, configurations, and enable lateral movement — prompting an urgent call to patch affected versions.