CVE-2023-38035: Ivanti MobileIron Sentry admin portal authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass with CVSS 9.8, KEV listing with known ransomware use, and near-certain EPSS probability.

What it is

Ivanti MobileIron Sentry versions 9.18.0 and below contain an authentication bypass in the MICS Admin Portal caused by an insufficiently restrictive Apache HTTPD configuration. An attacker can reach the administrative interface without valid credentials, which matters because that interface controls a mobile device management gateway.

Impact

An attacker gains unauthenticated access to the Sentry administrative interface, with high confidentiality, integrity and availability impact per the CVSS vector, and public reporting describes remote code execution following the bypass.

Attack surface

Reachable over the network via the administrative interface's API, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). The flaw is in the Apache HTTPD configuration fronting the MICS Admin Portal.

Exploitation

Listed in CISA KEV since 2023-08-22 with known ransomware campaign use, and EPSS 30-day probability is 0.9995 (99.97th percentile). Public exploit code is referenced by Packet Storm, so exploitation is both observed and widely available.

What to do

• Upgrade MobileIron Sentry to a version above 9.18.0 per the Ivanti advisory; patch first.
• If patching is not immediately possible, restrict network access to the MICS Admin Portal and its API to trusted management networks only.
• Apply the vendor's configuration mitigations for the Apache HTTPD front end as described in the Ivanti advisory.
• Discontinue use of the product if no mitigation is available, as directed by CISA KEV required action.
• Audit admin accounts and credentials on Sentry for signs of unauthorized changes after exposure.

Detection

• Review Sentry and Apache HTTPD logs for unauthenticated or anomalous requests to MICS Admin Portal API endpoints.
• Hunt for unexpected administrative logins, configuration changes, or new accounts on Sentry appliances.
• Monitor for outbound connections or process execution on Sentry hosts consistent with post-exploitation remote code execution.
• Check network telemetry for external hosts reaching the Sentry admin interface from outside trusted management ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.