A pre-authentication remote code execution flaw in Ivanti Sentry just scored a perfect 10 on the CVSS scale, and a working proof-of-concept exploit is already public.
The vulnerability, tracked as CVE-2026-10520, lets an unauthenticated attacker run arbitrary code on Ivanti Sentry, a gateway product enterprises use to manage and secure mobile device access. Researchers published a proof-of-concept exploit shortly after disclosure, collapsing the window between patch availability and attacker capability. CISA moved to add the flaw to its Known Exploited Vulnerabilities catalog, the agency's signal that active exploitation is either confirmed or considered imminent. No authentication is required, meaning any internet-exposed instance is a potential foothold.
Ivanti products sit at the network perimeter, which makes them high-value targets, and the company's security track record has been under sustained pressure. Multiple critical zero-days across its product line over the past two years — including flaws in Connect Secure that drew nation-state interest — have put Ivanti on the short list of vendors that defenders watch closely. A CVSS 10.0 pre-auth RCE with a public proof of concept on a gateway product is the kind of disclosure that moves from patch available to actively weaponized in hours, not days.
A perfect severity score, a public exploit, and a CISA KEV listing in combination is about as loud as the industry gets at telling you to patch now.