Critical RCE in Ivanti Sentry (Unauthenticated OS Command Injection) - CVE-2026-10520

Authentication bypass in Ivanti Sentry prior to R10.5.2, R10.6.2, and R10.7.1 allows remote attackers to create arbitrary administrative accounts and gain full admin control of the mobile management gateway. The flaw is rated CVSS 9.9 with a scope-changed vector, indicating compromise extends beyond the immediate vulnerable component. No public exploit identified at time of analysis, though Ivanti Sentry has a recurring history of being targeted by advanced threat actors.