CVE-2023-39338 MEDIUM

CVE-2023-39338

Vendor Ivanti
Product Sentry
Published July 12, 2025
Last update February 26, 2026

CVSS base score

6.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.

Key dates

02Disclosure timeline

July 12, 2025 CVE published
February 26, 2026 Record updated