CVE-2023-38035

CRITICAL 9.8

⚠️ CISA KEV

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

Vendor	ivanti
Product	mobileiron sentry
Ecosystems	VPN Networking
Industries	SecurityNetworking
Published	Aug 21, 2023
Last Updated	Oct 21, 2025

⚠️ Actively Exploited — Act Now

Get instant alerts for ivanti mobileiron sentry

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2023-38035.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Ivanti / MobileIron Sentry

9.18.0 and below < 9.18.0 and below

References

NVD ↗ CVE.org ↗ EPSS Data ↗

forums.ivanti.com: https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface packetstormsecurity.com: http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035