CVE-2026-10520: command injection in Ivanti Sentry and the edge appliance pattern

FortiGuard Labs continued to see exploitation attempts against CVE-2026-10520 in Ivanti Sentry, an on-premises gateway placed at the network edge for MDM deployments. The flaw lets attackers run commands on an internet-reachable appliance and stayed on the outbreak list for roughly two months after technical details were published.

• Ivanti Sentry sits at the network edge and is reachable from the internet without a foothold
• Command injection runs with the privileges of the appliance's service account
• The entry remained on FortiGuard's outbreak list for about two months
• The same feed lists Orkes Conductor RCE CVE-2026-58138 and a PAN-OS GlobalProtect bypass