Is CVE-2023-38035 (Ivanti Sentry Authentication Bypass) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-38035 to its Known Exploited Vulnerabilities catalogue on 22 August 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

What the KEV listing means for this Ivanti Sentry flaw

CISA’s KEV catalogue is the practical signal that matters most here. Once a CVE is added, defenders should treat it as an exploitation-in-the-wild issue, not as a theoretical weakness. For Ivanti Sentry, that means the administrative interface exposure is the first place to validate, because the bypass is tied to how access control is enforced on the appliance itself.

For internet-facing appliances, the question is not only whether a patch exists, but whether the management surface was ever reachable from untrusted networks. An authentication bypass on an admin interface can collapse the normal trust boundary entirely, especially when the device sits between external users and internal services. Edge Device Security Guide is useful background on why exposed management paths and logging gaps matter so much on edge systems.

How defenders should confirm exposure and scope

Start by identifying every Ivanti Sentry deployment, every instance that may still be reachable from the internet, and every administrative path that could have been exposed before remediation. If the appliance was reachable externally, assume the management plane deserves the same urgency as a perimeter VPN or gateway, because these products often sit on high-trust edges and can be abused before normal user authentication even begins.

Then verify whether the device was only vulnerable in principle or whether it was actually accessible during the exposure window. That distinction affects how aggressively you hunt for follow-on activity, but it does not change the need to remediate. The broader lesson is the same one seen in other appliance compromises: attackers tend to target management interfaces because they offer concentrated privilege and a short path to control. Ivanti Connect Secure exploitation 2024 is a useful comparison point for why edge-device compromise can become credential and session exposure quickly.

What to do if patching or mitigation has to wait

If immediate remediation is not possible, reduce exposure of the administrative interface first. Restrict access to management paths, remove unnecessary internet reachability, and monitor for any request patterns that indicate probing or abuse of the admin surface. For a flaw that bypasses authentication, compensating controls are only meaningful if they actually shrink who can reach the vulnerable path.

Once the exposure window is known, look for evidence that the device was used as a stepping stone. That includes unexpected admin actions, altered configuration, new accounts, unusual logins, or attempts to pivot into adjacent systems. When an appliance flaw sits at the edge, compromise assessment is not optional because the attacker may have acted before defenders had any warning. Zero-Day and Exploited Vulnerabilities Guide is the best general reference for triaging exploited flaws, emergency mitigation, and post-patch hunting.

Risk and Threat Considerations

An authentication bypass on an administrative interface is dangerous because it removes the normal control point that stands between the internet and a high-privilege device. On an appliance like Sentry, that can turn a single flaw into configuration tampering, credential exposure, traffic interception, or a launch point into internal systems.

Failure mechanism: The attacker does not need valid administrative credentials if the HTTPD configuration allows the bypass condition to defeat the intended access check, so the management plane can be reached as though authentication had already succeeded.

Impact: Successful abuse can expose stored secrets, weaken perimeter controls, and create a durable foothold on an edge device that defenders often trust as part of the network boundary.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The issue is a known exploited vulnerability requiring rapid prioritisation and remediation.
Recommendation — Prioritize KEV-listed Ivanti Sentry remediation and verify closure of exposed management paths.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The CVE requires timely remediation and tracking of exploited software flaws.
	AC-3 — Access Enforcement	The vulnerability bypasses administrative authentication and defeats intended access enforcement.
Recommendation — Patch or mitigate the Sentry flaw promptly and document remediation status. Enforce administrative access restrictions and remove unnecessary management exposure.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The flaw affects an exposed administrative interface on an internet-facing appliance.
Recommendation — Hunt for exploitation attempts against the exposed Sentry management interface.
OWASP API Security Top 10	API2 — Broken Authentication	The CVE is an authentication bypass, which is a direct authentication failure pattern.
Recommendation — Validate that administrative authentication checks cannot be bypassed on exposed interfaces.

Practitioner Guidance

What to verify: Confirm whether any Sentry node was internet reachable, whether the vulnerable administrative path was exposed, and whether logs still exist for the affected period. If logs are incomplete, treat that as a visibility problem, not as reassurance.

Decision rule: If the device could be reached from untrusted networks before remediation, prioritize compromise assessment and credential review alongside patching. If the appliance only served an internal management segment, the urgency remains high, but the blast radius is usually narrower.

What practitioners underestimate: Edge appliances are often treated as infrastructure, not as systems that can be directly abused for access. That assumption is risky when the flaw is an authentication bypass, because the first successful request may already be the compromise.

Practitioner takeaway: For KEV-listed appliance flaws, exposure review and compromise hunting should happen together, because the main operational question is not just “is it patched?” but “was the trust boundary already crossed?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org