The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to patch a critical Ivanti Sentry vulnerability within three (3) days under its newly issued Binding Operational Directive (BOD) 26-04 after confirming active exploitation in the wild. The maximum-severity flaw, tracked as CVE-2026-10520, is an OS command injection vulnerability affecting Ivanti Sentry security gateway appliances, and was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog shortly after security researchers observed widespread exploitation attempts. Despite Ivanti initially stating it had no evidence of active attacks when patches were released, the Shadowserver Foundation reported that numerous internet-exposed Sentry gateways had already been compromised and backdoored, warning that unpatched systems are likely breached. BOD 26-04, which replaces previous federal patching directives, prioritizes rapid remediation of internet-facing, actively exploited vulnerabilities capable of granting attackers significant control over affected systems. The directive’s first application to CVE-2026-10520 highlights growing concerns over the continued exploitation of Ivanti products, with CISA having previously tracked thirty-five (35) exploited Ivanti vulnerabilities, including a dozen leveraged by ransomware operators. CTIX analysts urge all administrators to patch their systems and conduct internal investigations to ensure they have not already been compromised.