The perfect CVSS 10.0 vulnerability dropped yesterday

A vulnerability landed on CISA’s Known Exploited Vulnerabilities list yesterday with a CVSS score of 10.0. That is the highest severity rating the Common Vulnerability Scoring System allows. Pre-authentication remote code execution, no user interaction required, full system compromise. The theoretical worst case. Ivanti Sentry is an enterprise mobile gateway product. The flaw lets an unauthenticated attacker execute arbitrary code on the appliance without touching a keyboard. Public proof-of-concept exploit code is already circulating, which means the window between disclosure and active exploitation is measured in hours, not weeks. CVSS 10.0 vulnerabilities are rare because the scoring system requires a perfect storm: network-accessible, no privileges needed, no complexity in exploitation, complete confidentiality and integrity impact, full availability impact. Most critical bugs still require some precondition. This one does not. CISA adding it to the KEV catalogue this fast tells you how seriously US federal agencies are taking it. The KEV list is not a general advisory feed. It is a binding directive for government networks: patch this or disconnect the device. When a bug makes that list within days of disclosure, it means someone is already scanning for it in the wild. Ivanti has had a rough year for security. This is the third major pre-auth RCE in their product line since January. At some point the pattern stops being bad luck and starts being an architecture problem. If your edge appliances keep shipping with network-accessible code execution flaws, the threat model is wrong at design time. The public PoC changes the math for defenders. You cannot rely on obscurity or hope attackers will not figure out the exploit path. The path is published. If you run Ivanti Sentry and have not patched yet, you are one port scan away from someone owning your perimeter.

---

Source: Ivanti Sentry pre-auth RCE (CVE-2026-10520) – CVSS 10.0, public PoC, CISA KEV