Ivanti Sentry Authentication Bypass Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2023-38035 · Published 21/08/2023 · updated 17/06/2026

Ivanti Sentry Authentication Bypass Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/08/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

In short

CVE-2023-38035 is a CRITICAL (CVSS 9.8) vulnerability affecting mobileiron sentry (ivanti).
Exploited in the wild: CISA added it to the KEV catalog on 22/08/2023.
Chance of exploitation in the next 30 days (EPSS): 100.0%, higher than 100.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mobileiron sentry ivanti	`≤ 9.18.0`	No fix yet

Description

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

References

packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html · Exploit
forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-38035

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free