CVE-2023-38035
CRITICALCISA KEVEPSS 100th pctlDescription
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
How to fix
Actively exploited, no published fix found yet
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal remediation due: 2023-09-12
Known ransomware campaign use
Mitigation guidance may be in the linked vendor advisories in the References section below.
TridentStack Control tracks known vulnerabilities across your Windows, macOS, and Linux fleet and shows the fix as soon as one is published. See how it works
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit Intelligence
Very high risk: more likely to be exploited than 100% of all known CVEs.
Ivanti Sentry Authentication Bypass Vulnerability
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Remediation due: 2023-09-12
Associated with ransomware campaigns
References
Related Vulnerabilities
Other CWE-863 (Incorrect Authorization) vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2023-22518 | Critical | 9.8 | 100% | KEV + Ransom | Fix |
| CVE-2022-46169 | Critical | 9.8 | 100% | KEV | Fix |
| CVE-2024-38856 | Critical | 9.8 | 99% | KEV | Fix |
| CVE-2025-29927 | Critical | 9.1 | 99% | - | Fix |
| CVE-2020-36289 | Medium | 5.3 | 99% | - | Fix |
| CVE-2022-0824 | High | 8.8 | 97% | - | Fix |
Embed a live status badge for CVE-2023-38035
Markdown
[](https://tridentstack.com/cve/CVE-2023-38035)HTML
<a href="https://tridentstack.com/cve/CVE-2023-38035"><img src="https://tridentstack.com/cve/badge/CVE-2023-38035.svg" alt="CVE-2023-38035"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-10-31.