Ivanti released patches for two critical Sentry vulnerabilities: CVE-2026-10520, an OS command injection that lets attackers execute code as root, and CVE-2026-10523, an authentication bypass for creating rogue admin accounts. No active exploitation has been seen, but administrators should upgrade to Sentry R10.5.2, R10.6.2 or R10.7.1 immediately.