Ivanti Sentry (versions before 10.5.2, 10.6.2, and 10.7.1)
A security gateway appliance (formerly MobileIron Sentry) that organisations use to manage and secure mobile device access to enterprise email and internal applications.
Root Cause
The software passes attacker-supplied input directly into system commands without checking what it contains. The device treats whatever is submitted as a legitimate instruction and executes it, with no authentication step in between.
Attack Vector
An attacker sends a crafted HTTP request to the exposed admin portal, with malicious OS commands embedded in the payload. No credentials are needed. The server processes the request and runs the injected commands with root-level privileges, granting the attacker full control of the device from a single unauthenticated connection.
Detection Notes
- Unexpected outbound connections from the Sentry appliance to unfamiliar external addresses.
- Admin portal logs showing access from unknown source IPs, particularly around or after June 10.
- New processes running at root level on the appliance that were not present before patching.
Recommended Actions
- Upgrade to Ivanti Sentry 10.5.2, 10.6.2, or 10.7.1 immediately (patches released June 10).
- Block admin portal endpoints from public internet access now, regardless of patch status.
- Enable mTLS (mutual TLS — where both sides of a connection must verify each other's identity) if your deployment supports it.