---
id: "CVE-2023-38035"
kind: "vulnerability"
aliases: ["CVE-2023-38035"]
title: "A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Ivanti Sentry", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ivanti mobileiron sentry", "fixed": [], "affected": "<= 9.18.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ivanti-sentry", "mobileiron-sentry", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2023-08-21T17:15:47+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38035", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38035", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow…

Ivanti Sentry has an authentication bypass in its administrative interface, caused by an overly permissive Apache HTTPD configuration. An attacker can reach admin functions without valid credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ivanti Sentry affected ? fixed ?
- vendor:ivanti mobileiron sentry affected <= 9.18.0 fixed ?

## Fix

Apply the mitigations from Ivanti's advisory; CISA says to discontinue use of the product if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38035
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-38035

## From the sources

Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_