Research · Jun 9, 2026
Critical OS Command Injection Vulnerability in Ivanti Sentry
A severe OS command injection vulnerability in Ivanti Sentry could allow remote unauthenticated users to execute code, raising significant security concerns for affected organizations.
What changed
Ivanti Sentry, a product formerly known as MobileIron Sentry, has been identified with a critical OS command injection vulnerability. This flaw could potentially enable remote unauthenticated users to execute commands at the root level.
The vulnerability is particularly concerning when the Sentry appliance is in an unmanaged state, making its endpoints accessible from the outside.
- Remote code execution risk due to command injection flaw.
- Exploitation is possible under specific unmanaged conditions.
- Increased urgency for organizations to assess their Sentry configurations.
Who is affected
Organizations utilizing Ivanti Sentry are at risk, particularly those with endpoints that are externally reachable without proper management.
The vulnerability poses a threat to any enterprise relying on Ivanti's mobile device management solutions.
- Ivanti Sentry users with unmanaged appliances.
- Organizations using mobile device management systems.
- IT departments responsible for endpoint security.
What to do
Affected organizations should prioritize reviewing their Ivanti Sentry configurations and ensure that endpoints are not left unmanaged.
Implementing mTLS with EPMM or restricting HTTPS access through Neurons for MDM can help mitigate the exposure.
- Review and audit Sentry appliance configurations.
- Enable mTLS and restrict access to mitigate risks.
- Stay informed on updates and patches from Ivanti.