What’s Vulnerable › Vulnerabilities

CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-08-22
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-21 · updated 2026-06-17
• Weakness: CWE-863

Description

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

Affected products

• Ivanti MobileIron Sentry: through 9.18.0

References

• http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
• http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035

Get alerted when CVE-2023-38035 or the next vulnerability affects your stack