CISA Orders Federal Agencies to Patch Actively Exploited Ivanti Vulnerability

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency has issued a binding operational directive ordering federal agencies to patch an actively exploited vulnerability in Ivanti Sentry software within three days.

The agency, known as CISA, released Binding Operational Directive BOD-26-04 on Thursday morning, mandating immediate action against the flaw identified as CVE-2026-10520. The directive cites active exploitation of the vulnerability in ongoing cyberattacks targeting federal systems.

CISA officials stated that the unpatched software poses significant risks to the integrity and security of the federal enterprise network infrastructure. Agencies are required to remediate the issue by applying available vendor patches or implementing compensating controls within 72 hours of receiving the directive.

The vulnerability affects Ivanti Sentry, a remote monitoring and management tool widely used across government networks for system administration tasks. Security experts warn that attackers could leverage the flaw to gain unauthorized access to sensitive systems without authentication.

Federal agencies must report their compliance status to CISA within five days following the initial three-day remediation window. The directive applies to all executive branch departments, independent agencies, and military branches operating under federal jurisdiction.

Ivanti has released patches addressing CVE-2026-10520 for affected versions of its Sentry platform. Organizations are advised to update immediately or isolate vulnerable systems from external networks until remediation is complete.

This marks the latest escalation in cybersecurity threats targeting U.S. government infrastructure following a series of coordinated attacks earlier this year. CISA has previously issued similar binding directives regarding critical vulnerabilities in other enterprise software platforms.

Agency spokespeople declined to comment on specific incidents related to CVE-2026-10520 or confirm whether any federal systems have already been compromised by the active exploitation mentioned in the directive.

The rapid timeline reflects CISA's assessment that the threat is imminent and requires urgent attention from federal IT security teams. Failure to comply with binding operational directives can result in increased scrutiny of agency cybersecurity practices and potential resource reallocation.

Cybersecurity analysts note that remote management tools are frequent targets for nation-state actors seeking persistent access points within government networks. The three-day window leaves little margin for error during patch deployment across complex federal IT environments.

CISA continues to monitor the threat landscape closely as agencies work to secure their systems against this specific vulnerability.