Medium severity · published Jul 12, 2025
CVE-2023-39338
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service
6.8
CVSS
0.9%
EPSS
No
On KEV
Description
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sentry · Ivanti
9.0 before 9.20 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39338
forums.ivanti.com
https://forums.ivanti.com/s/article/CVE-2023-39338
More from Sentry
10.0
CVE-2026-10520
Ivanti Sentry OS Command Injection Vulnerability
9.8
CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
9.8
CVE-2026-10523
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary…
8.8
CVE-2023-41724
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the…
8.1
CVE-2026-83527
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access