CVE-2023-38035

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

Affected

Ivanti · MobileIron Sentry

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99.95% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2023-08-22, used in ransomware campaigns

Nuclei

critical · CWE-863

Published

2023-08-21

Updated

2025-10-21

Proof-of-concept exploits (6)

• http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Co…
• LeakIX/sentryexploit7★ · 2023-08-25
• horizon3ai/CVE-2023-3803540★ · 2023-08-23
• mind2hex/CVE-2023-380351★ · 2023-09-05
• mind2hex/CVE-2023-38035-MobileIron-RCE1★ · 2023-09-05
• mind2hex/MICS_Hunter1★ · 2023-09-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38035.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_sentry_misc_lo…

Exploit collections (1)

• CVE-2023-38035.yamlzan8in/afrog

Security advisories

• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Ad…

References

• CVE Record
• NVD entry

Related

• CVE-2019-16113
• CVE-2019-17240
• CVE-2021-31630
• CVE-2022-39986
• CVE-2022-46169
• CVE-2025-6998