Endpoint Manager Mobile and Sentry
CVE-2023-38035: Sentry Authentication Bypass
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| MobileIron Sentry 9.18 | 9.18.0 and below or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Exploitation
CISA lists this CVE as exploited in the wild since 22 Aug 2023, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.