TI-2023-20477 Aliases CVE-2023-39338 GHSA-94xh-prxv-w7r3

Incorrect permission assignment in Ivanti Sentry

LOW 34CWE-732Published 2025-07-12 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00857 58th percentileScored 2026-11-07

Fix Fixed Sentry (Ivanti): 9.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ivanti	Sentry	9.0 to before 9.20	9.20	Patch available	CNA

Sentry VendorIvanti Affected 9.0 to before 9.20 Fixed in 9.20 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:ivanti:standalone_sentry::::::::	—	—	Ivanti

cpe:2.3:a:ivanti:standalone_sentry:*:*:*:*:*:*:*:* Versions — — ·Ivanti

Remediation

Fix · CNA Sentry (Ivanti) Fixed in 9.20

Timeline

2026-10-02 Threatist record created from CVE-2023-39338
2026-10-03 Alias added: GHSA-94xh-prxv-w7r3

References

Other 1

https://forums.ivanti.com/s/article/CVE-2023-39338

TI-2026-09047 OS command injection in Ivanti Sentry KEVCVSS 3.1CRITICAL 10.0
TI-2026-01051 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. KEVCVSS 3.1CRITICAL 9.8
TI-2026-00997 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. KEVCVSS 3.1CRITICAL 9.8
TI-2025-16349 Stack-based buffer overflow in Ivanti Connect Secure KEVCVSS 3.1CRITICAL 9.8
TI-2024-12207 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8
TI-2024-12206 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and… KEVCVSS 3.1CRITICAL 9.8

See all 524 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences