Ivanti MobileIron Sentry MICS Admin Portal Authentication Bypass and Remote Code Execution Vulnerability (CVE-2023-38035) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTIvanti MobileIron Sentry versions 9.18.0 and below with MICS (Mobile IT Connector System) Admin Portal enabled
Unauthenticated attackers can bypass authentication controls on the administrative interface, leading to remote code execution (RCE) and full system compromise
Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must apply the official security patches provided by Ivanti immediately. Access the Sentry CLI to verify the current version and install the updates.
# Access Sentry CLI and check the current software version
show version
# Install the latest security updates and hotfixes
software update install2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the MICS Admin Portal (default port 8443) using firewalls or security groups. Ensure that only trusted administrative IP addresses can access this port.
# Example: Block external access to port 8443 and allow only a trusted admin IP (e.g., 192.168.10.50)
iptables -A INPUT -p tcp -s 192.168.10.50 --dport 8443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP3. Log Audit & IoC Verification Commands
Inspect the Apache HTTPD access logs for unauthorized POST requests targeting the MICS API endpoints (/mics/ or related paths) that returned a 200 OK status code.
# Search Apache access logs for suspicious POST requests to MICS endpoints
grep -E '/mics/|/services/' /var/log/httpd/access_log | grep 'POST' | grep ' 200 'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-38035) is a critical authentication bypass vulnerability in the MICS (Mobile IT Connector System) Admin Portal of Ivanti MobileIron Sentry. The root cause lies in an insufficiently restrictive Apache HTTPD configuration on the administrative interface. Due to this misconfiguration, access control rules for sensitive API endpoints are not properly enforced, allowing remote attackers to access administrative APIs without valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending specially crafted HTTP POST requests directly to the MICS administrative interface (typically running on TCP port 8443). By bypassing the authentication layer, the attacker gains access to administrative API endpoints. These APIs can be abused to execute system commands or modify configurations, enabling the attacker to chain the authentication bypass with command injection to achieve full Remote Code Execution (RCE) under the privileges of the web server.
3. Infrastructure & Business Impact
Since Ivanti MobileIron Sentry acts as a secure gateway between external mobile devices and internal corporate networks, a compromise of this appliance poses a severe threat. Attackers can use the compromised Sentry server as a beachhead for lateral movement into the internal network. This vulnerability has a CVSS score of 9.8 and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog.
Official Vendor Advisories & References
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Frequently Asked SecOps Questions (CVE-2023-38035)
FAQQ1. How critical is CVE-2023-38035 and is it actively exploited in the wild?
CVE-2023-38035 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-38035?
Primary impacted vendors include ivanti across mobileiron_sentry. Scope summary: Ivanti MobileIron Sentry versions 9.18.0 and below
Q3. What temporary mitigations or workarounds exist for CVE-2023-38035 before patching?
[Mitigation] Immediately apply the official vendor patches and restrict external access to the MICS administrative port (default TCP 8443) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-38035
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ivanti)
View Category →Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)
[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.