Ivanti Sentry Pre-Authentication RCE

What is the Vulnerability?

What is the recommended Mitigation?

Affected:

Ivanti Sentry 10.5.1 and earlier

Ivanti Sentry 10.6.1 and earlier

Ivanti Sentry 10.7.0 and earlier

Fixed:

10.5.2

10.6.2

10.7.1

Recommended Actions

• Immediately upgrade to Ivanti Sentry 10.5.2, 10.6.2, or 10.7.1.

• Assume internet-exposed, unpatched appliances may already be compromised.

• Review administrative accounts for unauthorized additions.

• Search for web shells, persistence mechanisms, and suspicious root-level processes.

• Rotate credentials and invalidate tokens if compromise is suspected.

• Monitor for exploitation attempts and anomalous outbound connections.

• Enable IPS protections and virtual patching while emergency updates are being deployed.

What FortiGuard Coverage is available?

• FortiGuard IPS provides protection against exploit attempts targeting vulnerable Ivanti Sentry appliances.

• FortiGuard Web Filtering blocks access to known malicious infrastructure used to host payloads or support post-exploitation command-and-control activity.

• FortiGuard AntiVirus detects and blocks malware payloads, web shells, and other malicious files delivered following successful exploitation.

• FortiEDR detects suspicious post-exploitation behavior, including unauthorized command execution, persistence mechanisms, privilege abuse, and lateral movement originating from compromised systems.

• FortiGuard Incident Response Service assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.