CVE-2023-38035Ivanti Sentry authentication bypass
What broke
Ivanti Sentry, the gateway that sits in front of EPMM / MobileIron, exposed an administrative API without authentication. CISA added CVE-2023-38035 to KEV. August 2023, weeks after CVE-2023-35078 on EPMM itself.
Why it matters
Sentry terminates device and app traffic and often holds the keys that talk to EPMM. An auth bypass on the gateway is how you skip the MDM you just patched. Ivanti's 2023-2025 record (EPMM, Sentry, Connect Secure) is one product family failing authentication over and over.
What to do
- Patch Sentry. If it was internet-facing in August 2023, review admin users and certificates it issued.
- Do not expose Sentry admin or its system API to the internet.
- Treat Ivanti appliances as one identity system: patch EPMM, Sentry, and Connect Secure on the same cadence.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2023-38035
- CISA KEV
- Ivanti Sentry advisory, August 2023
Related identity CVEs
Related on Start with Identity
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the