Ivanti, a leading provider of unified endpoint management solutions, has recently issued a critical security advisory to its customers. The company is urging users of its Sentry product to patch two severe vulnerabilities that could have far-reaching consequences. These vulnerabilities, CVE-2026-10520 and CVE-2026-10523, highlight the ongoing challenges in securing enterprise software.
The Severity of the Vulnerabilities
The first vulnerability, CVE-2026-10520, is a remote code execution (RCE) flaw with root privileges. This type of vulnerability is considered one of the most critical, as it allows an attacker to execute arbitrary code on the system with administrative rights. The fact that it is unauthenticated means that an attacker can exploit it without any prior access, making it even more dangerous. While Ivanti claims that no successful exploitation has occurred in the wild, the potential for such an attack is concerning.
The vulnerability stems from an exposed API running under Apache Tomcat. By crafting a specially designed message, an attacker can manipulate the API to execute commands with root privileges. Ivanti's response involved blocking the acceptance of attacker-supplied strings and replacing them with hard-coded commands. They also updated Apache configuration rules to prevent unauthenticated access to the affected endpoint, which is a positive step towards mitigating the risk.
The second vulnerability, CVE-2026-10523, is an authentication bypass bug. It allows remote, unauthenticated attackers to create admin accounts, granting them top privileges on the affected system. This vulnerability is also rated as near-maximum severity, with a CVSS score of 9.9. The impact of this bug is significant, as it can lead to complete control of the system by unauthorized individuals.
Impact and Recommendations
Both vulnerabilities affect Ivanti Sentry, a mobile gateway that is part of the company's unified endpoint management platform. The potential for widespread impact is high, as these vulnerabilities can be exploited by attackers to gain unauthorized access and control over enterprise networks. It is crucial for customers to address these security flaws immediately.
Ivanti recommends upgrading to versions 10.5.2, 10.6.2, or 10.7.1 to patch these critical vulnerabilities. The company's proactive approach to addressing these issues is commendable, but it also highlights the ongoing need for vigilance in the face of evolving cybersecurity threats.
A Pattern of Vulnerabilities
This recent disclosure comes on the heels of two separate critical vulnerabilities in Ivanti's Endpoint Manager Mobile (EPMM) in January. These bugs, also rated as 9.8 CVSS, were exploited as zero-days, and even the Dutch data protection authority reported a breach to the parliament. The pattern of vulnerabilities in Ivanti's products raises questions about the effectiveness of their security measures and the importance of timely patching.
In conclusion, Ivanti's recent security advisory serves as a stark reminder of the critical nature of software security. The company's quick response to address these vulnerabilities is a positive step, but it also underscores the need for continuous improvement and vigilance in the face of evolving cyber threats. As organizations rely more on endpoint management solutions, ensuring their security and resilience becomes increasingly vital.
