At Ivanti, our top priority is upholding our commitment to deliver and maintain secure products. We continue to invest significant resources to ensure that all our solutions continue to meet our own high standards. 

A vulnerability has been discovered in Ivanti Sentry, formerly MobileIron Sentry. We have reported this as CVE-2023-38035. This vulnerability impacts all supported versions – Versions 9.18. 9.17 and 9.16. Older versions/releases are also at risk. This vulnerability does not affect other Ivanti products or solutions, such as Ivanti EPMM, MobileIron Cloud or Ivanti Neurons for MDM. 

If exploited, this vulnerability enables an unauthenticated actor to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal (commonly, MICS). While the issue has a high CVSS score, there is low risk of exploitation for customers who do not expose 8443 to the internet. 

Upon learning of the vulnerability, we immediately mobilized resources to fix the problem and have RPM scripts available now for all supported versions. We recommend customers first upgrade to a supported version and then apply the RPM script specifically designed for their version. More detailed information is available in this Security Advisory.  

Our Support team is always available to help customers. Cases can be logged via the Success portal (login credentials required). 

Ivanti would like to thank mnemonic for their assistance in identifying this vulnerability. 

Want to stay up to date on Ivanti Security Advisories? Click the RSS symbol at the top of this page and then paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / RSS functionality in your email program.