Contain Ivanti Exposure, Reassess Patch SLAs and Supplier Risk

" Internet-exposed Ivanti Sentry admin portals (Shadowserver) ​On Thursday, CISA also confirmed that the CVE-2026-10520 vulnerability is now actively exploited in attacks and added it to its Known Exploited Vulnerabilities Catalog (KEV), ordering Federal Civilian Executive Branch (FCEB) agencies to secure their Ivanti Sentry instances within three days, as required by Binding Operational Directive (BOD) 26-04

While Shadowserver now tracks just over 50 Sentry admin portals exposed online, it says the number of Internet-exposed Ivanti Sentry instances it can detect is likely limited by organizations blocking its security scanner, and warns that systems that weren't already patched are likely compromised

Ivanti has yet to update its advisory to warn that CVE-2026-10520 is under active exploitation, and an Ivanti spokesperson has not responded when contacted by BleepingComputer for further details on these ongoing attacks. While Shadowserver now tracks just over 50 Sentry admin portals exposed online, it says the number of Internet-exposed Ivanti Sentry instances it can detect is likely limited by organizations blocking its security scanner, and warns that systems that weren't already patched are likely comprom

' UPDATED Following notes from several readers, we followed up directly with VRChat on Thursday at 1945 GMT and they told us that the Maine Attorney General's office apparently posted a fake breach report

It confirmed the “data security incident” in a report filed with Maine’s attorney general, but has not disclosed it via public channels

' UPDATED Following notes from several readers, we followed up directly with VRChat on Thursday at 1945 GMT and they told us that the Maine Attorney General's office apparently posted a fake breach report. According to an email from VRChat's head of community, Charles Tupper, "VRChat did not submit this Notice of Data Incident, and the employee/email cited does not exist

The directive aims to reduce the threat of cyberattacks targeting the public sector by requiring agencies to remediate high-risk vulnerabilities within accelerated timeframes, in some cases as little as three days. CISA says that BOD 26-04 “supersedes and revokes” the older BOD 19-02 and BOD 22-01, introduced in 2019 and 2021, respectively

The vulnerability management processes should be updated in 60 days to use CVE and KEV data as the basis for remediation decisions. Within 180 days, all agencies will be required to follow the new remediation timelines and continuously monitor and report detailed asset metadata

Right now, agencies bound to the BOD 26-04 directive should update their vulnerability management policies accordingly, update their asset inventories, and automate KEV status reporting. The vulnerability management processes should be updated in 60 days to use CVE and KEV data as the basis for remediation decisions

It adds to a grim week for cybersecurity in the education sector

CYBER-CRIMe Great Marlow restricts network access while it investigates suspected infection Great Marlow School in Buckinghamshire, England, has entered its second day of a shutdown following "a suspected malware incident

"We are responding in line with guidance from the Department for Education (DfE) and the National Cyber Security Centre (NCSC)

Formerly known as MobileIron Sentry, the Ivanti Sentry security gateway appliance secures traffic between back-end corporate systems and remote mobile devices. Tracked as CVE-2026-10520, the maximum-severity vulnerability stems from an OS command injection weakness and was patched by Ivanti on Tuesday with the release of Sentry versions R10

Formerly known as MobileIron Sentry, the Ivanti Sentry security gateway appliance secures traffic between back-end corporate systems and remote mobile devices

Attackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways