CVE-2023-38035Ivanti Sentry authentication bypass

What broke

Ivanti Sentry, the gateway that sits in front of EPMM / MobileIron, exposed an administrative API without authentication. CISA added CVE-2023-38035 to KEV. August 2023, weeks after CVE-2023-35078 on EPMM itself.

Why it matters

Sentry terminates device and app traffic and often holds the keys that talk to EPMM. An auth bypass on the gateway is how you skip the MDM you just patched. Ivanti's 2023-2025 record (EPMM, Sentry, Connect Secure, addUser) is one product family failing authentication over and over.

What to do

• Patch Sentry. If it was internet-facing in August 2023, review admin users and certificates it issued.
• Do not expose Sentry admin or its system API to the internet.
• Treat Ivanti appliances as one identity system: patch EPMM, Sentry, and Connect Secure on the same cadence.

After you patch

Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.

• Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
• Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
• Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
• Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.

Sources

• NVD: CVE-2023-38035
• CISA KEV
• Ivanti Sentry advisory, August 2023