Executive Summary
In June 2026, research was published detailing a critical vulnerability in Ivanti Sentry (formerly MobileIron Sentry), an in-line gateway used for managing mobile device traffic. The primary flaw, CVE-2026-10520, is a pre-authenticated OS command injection with a maximum CVSS score of 10.0, enabling remote attackers to execute commands with root privileges.
The attack chain involves sending a specially crafted POST request to the `/mics/api/v2/sentry/mics-config/handleMessage` endpoint. The application fails to sanitize a user-supplied 'message' string, which is eventually passed to a native command execution method via reflection. A secondary vulnerability, CVE-2026-10523, allows for authentication bypass and the creation of administrative accounts.
Given Ivanti Sentry's role as a gateway between mobile devices and internal resources like Microsoft Exchange, exploitation provides a direct path for attackers to pivot into sensitive corporate infrastructure. Organizations should prioritize patching to versions R10.5.2, R10.6.2, or R10.7.1 immediately.