CVE-2026-10520

CVE-2026-10520 in Ivanti Sentry carries both a CVSS 10 and an EPSS of 0.99889. Those two metrics together mean something most vulnerability communications obscure: this is not a severe vulnerability that might be exploited — exploitation is functionally certain within days. When you see EPSS approaching 1.0 on a 10.0, the distinction between 'critical severity' and 'imminent emergency' collapses. Your response cadence must reflect that, not treat it as another item in the priority queue. The compounding factor specific to this CVE is what Sentry actually is. This isn't an application with a single compromised host as the worst case. Sentry is your enterprise mobility management plane — it controls the configurations pushed to your entire mobile fleet. Achieving unauthenticated root on Sentry doesn't just give you one server; it potentially gives you the ability to push malicious profiles, certificates, or configuration changes to every enrolled device. The blast radius is systemic, not host-local, and standard criticality scoring obscures this. Your immediate technical priorities, in order: First, verify Sentry's administrative interfaces have zero exposure to untrusted networks — management access must terminate in a dedicated VLAN with ACLs permitting only MDM console sources. Second, if you cannot patch immediately, deploy a WAF with explicit rules blocking the authentication bypass and RCE paths known for this vulnerability, combined with aggressive rate limiting on all administrative API endpoints. Third, validate that your endpoint detection can alert on lateral movement from Sentry to enrolled devices. But the question you should be asking is not just 'what controls work?' It is: does your organization have a pre-authorized response sequence — not a plan, but an executed playbook — that activates when EPSS crosses a defined threshold? When exploitation certainty approaches 1.0, the bottleneck is never threat intelligence. It is whether someone can authorize network isolation at 2am without waiting for a weekly change advisory board. The organizations still writing runbooks when this CVE drops are already behind. The operational gap is not technical. It is whether your process permits the speed the threat model demands.

Reviewed through automated stages and approved by a human before publication.