Research · Jun 9, 2026 · ZeroDay Catalog
Critical OS Command Injection Vulnerability in Ivanti Sentry
A significant OS command injection vulnerability has been identified in Ivanti Sentry, potentially allowing remote code execution by unauthenticated users under specific conditions.
What changed
Ivanti Sentry, previously known as MobileIron Sentry, has been found to contain a critical OS command injection vulnerability. This flaw could enable a remote, unauthenticated attacker to execute arbitrary commands with root privileges on the affected system.
The vulnerability is particularly concerning when the Sentry appliance is in an unmanaged state, allowing external access to its endpoints.
Who is affected
Organizations utilizing Ivanti Sentry for mobile device management are at risk, especially if their configurations do not implement adequate security measures.
The vulnerability could impact any enterprise that has endpoints externally reachable without proper management or security controls.
- Ivanti Sentry users and administrators.
- Enterprises relying on Ivanti for mobile device management solutions.
- Organizations with unmanaged Sentry appliances exposed to the internet.
What to do
Immediate action is recommended for organizations using Ivanti Sentry. It is crucial to assess the current state of your Sentry appliances and implement necessary security measures to mitigate this vulnerability.
Consider employing mTLS with EPMM or restricting HTTPS access through Neurons for MDM to safeguard interfaces from external access.
- Review and update the configuration of Ivanti Sentry appliances.
- Implement security measures to restrict external access to endpoints.
- Monitor for any unusual activity that may indicate exploitation attempts.