CVE-2023-38035 is an authentication bypass vulnerability in Ivanti Sentry. CISA added it to the Known Exploited Vulnerabilities catalogue on 22 August 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in practice
An authentication bypass in an edge appliance is dangerous because it can turn a public-facing trust boundary into an unauthenticated entry point. For a product like Ivanti Sentry, that means an attacker may be able to reach protected functions without proving who they are, which can undermine the security assumptions of downstream systems that rely on Sentry for access control.
Because CISA added CVE-2023-38035 to the KEV catalogue on 22 August 2023, organisations should treat exposure as active and not theoretical. KEV inclusion is a strong signal that the issue has been used in real attacks and that patch timing matters.
How to assess exposure
The first question is whether Ivanti Sentry is present anywhere in the environment, including internet-facing deployments, remote access paths, and externally reachable management interfaces. Asset inventory matters here because edge products are often forgotten until they are already in the attack path.
Exposure review should then focus on whether the instance is reachable from the internet, whether it is still within the vulnerable product scope described by the vendor, and whether compensating controls are actually in place. Use the vendor advisory and the NIST National Vulnerability Database alongside the CVE Program for authoritative identification and version guidance.
For organisations that manage many internet-facing appliances, a vulnerability management process that prioritises KEV-listed issues is the right lens. Vulnerability Management Guide is useful here because it frames asset scope, KEV prioritisation, verification and exception handling as one workflow rather than separate tasks.
Why authentication bypass is high impact
Authentication bypass is not just a login bug. It can let an attacker move from unauthenticated network reachability to authorised application behaviour, which may expose sessions, configuration functions, integration points, or administrative actions depending on how the appliance is deployed.
In an edge security product, that is especially serious because compromise at the perimeter can be used to pivot into email, identity, VPN, or internal application access paths that trust the appliance. The issue is therefore broader than the appliance itself, because a successful bypass can weaken whatever downstream trust chain depends on it.
Ivanti Connect Secure exploitation 2024 shows how compromise of Ivanti edge appliances can expose credentials and related access material, which is why authentication issues in this product class are treated as high consequence events.
Remediation, mitigation and compromise review
Priority one is applying the vendor fix or approved mitigation as soon as possible, because a KEV-listed authentication bypass should not be left to normal patch cycles. If immediate patching is not possible, organisations should reduce exposure by limiting internet reachability, tightening network access to the appliance, and following the vendor’s documented mitigation path.
After remediation, the job is not done. Teams should review logs, authentication events, administrative changes, and any sign that the appliance was accessed unexpectedly before the fix was applied. If exploitation may have occurred, rotate any credentials, tokens, certificates, or service accounts that the appliance could have exposed or mediated.
SonicWall SSL VPN account compromises 2025 illustrates the downstream value of validating whether valid access paths, not just the vulnerability itself, were abused after exposure.
Risk and Threat Considerations
This vulnerability matters because authentication bypass on an edge appliance can convert a single exposed service into an organisation-wide access problem. If the appliance sits in front of sensitive traffic or privileged workflows, successful exploitation can create immediate unauthorised access and hidden persistence opportunities.
Failure mechanism: An attacker reaches the appliance over the network and triggers the bypass to skip authentication checks, then uses that access to interact with protected functions, harvest configuration details, or stage follow-on compromise.
Impact: The result can include unauthorised access, session abuse, credential exposure, lateral movement, and loss of trust in the appliance as a control boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE-2023-38035 requires urgent remediation of a known exploited flaw. |
| IA-2 — Identification and Authentication (Organizational Users) | The issue is an authentication bypass that defeats identity checks on the appliance. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analysing appliance and access logs for abuse. | |
| Recommendation — Prioritise and document remediation for the exploited authentication bypass. Enforce strong authentication controls on the appliance-facing access path. Review logs for signs that the bypass was used before remediation. | ||
| OWASP ASVS | V6 — Authentication | Authentication failure is the core vulnerability class in this CVE. |
| Recommendation — Validate that authentication checks cannot be bypassed in the affected path. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | The vulnerability breaks the access-control function that CSF protects. |
| Recommendation — Harden access control and authentication around the affected appliance. | ||
Practitioner Guidance
Why practitioners should care: Treat any KEV-listed authentication bypass in an internet-facing appliance as a high-priority security event, not a routine vulnerability ticket. The operational question is whether the device still provides a trustworthy perimeter after exposure.
What to watch for: Review authentication logs, unusual administrative actions, and any unexpected configuration or access changes before and after mitigation. If you cannot prove the appliance was clean, assume compromise review is required.
Practitioner takeaway: For edge appliances, patching closes the flaw, but only post-patch review tells you whether the bypass was already used.
Related resources from NHI Mgmt Group
- CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)
- CVE-2023-35078 (Ivanti Endpoint Manager Mobile Authentication Bypass)
- CVE-2023-46805 (Ivanti Connect Secure and Policy Secure Authentication Bypass)
- CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass)