A maximum-severity flaw in Ivanti Sentry — a gateway appliance many businesses use to broker mobile and remote access into their networks — is being mass-exploited right now. CISA added CVE-2026-10520 to its Known Exploited Vulnerabilities catalog on June 11 and gave federal agencies just three days to patch under the new Binding Operational Directive 26-04. That deadline expired Saturday, June 14, and security researchers are warning that any internet-exposed Sentry appliance that wasn't patched by now is most likely already compromised.
What the bug actually does
Ivanti Sentry (formerly MobileIron Sentry) is the gateway appliance that sits between a company's internal systems and its mobile or remote workforce. It helps companies manage and protect mobile access to corporate resources. If you have one, it's almost certainly internet-facing — that's the whole point of the box.
Tracked as CVE-2026-10520, the maximum-severity vulnerability stems from an OS command injection weakness and was patched by Ivanti on Tuesday with the release of Sentry versions R10.5.2, R10.6.2, and R10.7.1. Translated into plain English: an attacker on the internet, with no password, can send a crafted request to a vulnerable Sentry appliance and run commands as root. That's full control of the device — and the device is sitting at your network perimeter.
The CVSS score is a perfect 10.0, which is as bad as the rating system goes.
Why CISA hit the panic button in three days
Federal patch deadlines usually run two to three weeks. This one ran three days, and there's a reason.
While the company said at the time that it had no evidence of in-the-wild exploitation, the Shadowserver nonprofit security organization reported the next day that attackers had already backdoored most of the Sentry gateways exposed online. Within roughly 40 hours of a public proof-of-concept exploit being posted, attackers were ripping through exposed appliances and planting persistent access.
CISA ordered government agencies to patch the actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04. Tracked as CVE-2026-10520, this maximum-severity vulnerability was found in Ivanti's security gateway appliance and stems from an OS command injection weakness. CISA added it to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to secure their Ivanti Sentry instances within three days.
This is also not Ivanti's first appearance on the exploited list. CISA has now flagged 35 vulnerabilities across Ivanti's product line as actively exploited in attacks since 2020, 12 of which were leveraged in ransomware campaigns. If you run Ivanti gear, the realistic operating assumption is that another emergency patch cycle is always around the corner.
Does this affect small businesses in York County?
Most local small businesses don't run Ivanti Sentry directly. It's more common in mid-market companies, manufacturers, healthcare practices, and any organization that issued company-managed mobile devices to a remote workforce. If your office never bought into a mobile device management (MDM) platform, you can probably exhale.
But there are two indirect ways this story still lands on your desk. First, your vendors. If your bookkeeper, your legal counsel, your benefits administrator, or your payroll processor runs Ivanti Sentry and didn't patch by Saturday, their network may already be compromised — and your data may be sitting in it. Second, the pattern. The vulnerability is trivially exploitable on internet-exposed Sentry appliances not protected by mTLS with EPMM or restricted HTTPS through Neurons for MDM. Organisations that have not yet patched are now operating inside the final 24-hour window. The same playbook — public proof-of-concept exploit, mass scanning within hours, backdoors planted before IT teams finish their morning coffee — is now standard operating procedure for every edge device on your network: firewalls, VPN concentrators, file-transfer appliances, MDM gateways.
That's the work your IT provider should be doing in the background as part of a proper managed IT and cybersecurity program: maintaining a current inventory of every internet-facing device, monitoring CISA's KEV catalog daily, and patching emergency vulnerabilities in hours, not weeks.
What your IT provider should be doing this week
Whether you outsource IT to York Computer, another MSP, or a part-time consultant, here is the checklist a competent provider should be able to answer 'yes' to:
1. Confirm in writing whether your environment runs Ivanti Sentry, Ivanti EPMM, Ivanti Connect Secure, or any other Ivanti product. If yes, confirm the version and patch status against the June 10 release.
2. Pull a current inventory of every internet-exposed device — firewalls, VPNs, file-transfer servers, RMM tools, mail relays. You can't patch what you haven't inventoried.
3. Subscribe to and actually read CISA's Known Exploited Vulnerabilities catalog. The new directive tells federal agencies to prioritize patching if the asset is publicly exposed online, if the security flaw was added to CISA's KEV catalog, if exploitation can be automated for large-scale attacks, and if successful exploitation gives attackers partial or total control of a targeted system. That's a sensible filter for any small business, not just the feds.
4. If a Sentry appliance was internet-exposed and unpatched as of last week, treat it as compromised. Don't just patch — rotate credentials, review logs for unauthorized access, and check for persistence mechanisms.
5. Send your top vendors a short email this week asking whether they use Ivanti Sentry and, if so, when they patched. Vendor risk is your risk.
What York Businesses Should Do
York County small businesses — especially those in manufacturing, healthcare, and professional services that use managed mobile devices — should ask their IT provider this week whether any Ivanti product is in their environment and, if so, when it was last patched. If you're not sure who would answer that question for your business, that itself is the problem York Computer is built to solve.
Sources
- CISA orders feds to patch actively exploited Ivanti flaw by Sunday
- Max severity Ivanti Sentry vulnerability now exploited in attacks
- Ivanti Sentry Flaw Triggers CISA's First 3-Day Federal Patch Mandate, Already Exploited
- U.S. CISA adds Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog and urges patching by June 14
- Vulnerability Intelligence Report — June 13, 2026