CVE-2023-38035
Published 2023-08-21 · Updated 2026-06-17 · Source support@hackerone.com
Summary
CVE-2023-38035 is a critical-severity (CVSS 9.8) vulnerability in Ivanti Sentry. CISA added it to the Known Exploited Vulnerabilities catalog on August 22, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 12, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Ivanti has 38 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.
All 38 known-exploited Ivanti vulnerabilities →Description
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Ivanti — Sentry
Name: Ivanti Sentry Authentication Bypass Vulnerability
Date added: 2023-08-22 · Due: 2023-09-12
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
References
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035