The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited critical zero-day vulnerability in Ivanti Sentry (formerly MobileIron Sentry) to its Known Exploited Vulnerabilities (KEV) catalog. The advisory comes after researchers published a working proof-of-concept (PoC) exploit. Ivanti’s Sentry product is an in-line secure mobile gateway that allows administrators to manage and secure traffic between mobile devices and back-end enterprise systems. The flaw, tracked as CVE-2023-38035 (CVSS score of 9.8/10), is an authentication bypass vulnerability that could allow unauthenticated attackers to gain access to sensitive APIs. If successfully exploited, threat actors could make configuration changes on the administrative portal of Sentry that allow them to run commands and write files to victims’ systems. In the PoC, the researchers stated that the exploit “abuses an unauthenticated command injection to execute arbitrary commands as the root user.” An Ivanti spokesperson stated that at this time they are only aware of a limited number of impacted customers and didn’t specify any of the technical details surrounding the compromise. This flaw affects all supported versions of Sentry and customers are urged to restrict port 8443 (used to access the Ivanti Sentry administrative portal) from the public internet until they can apply the remediation. In Ivanti’s customer advisory, they state that each version of Sentry has its own dedicated script and if applied to the wrong versions, will not remediate the vulnerability. CTIX analysts recommend that all administrators responsible for their organization’s instance of Sentry follow the guidance in Ivanti’s advisory linked-below and apply the remediation script as soon as possible to prevent future exploitation. The vulnerability’s presence on the KEV mandates that all Federal Civilian Executive Branch (FCEB) agencies become compliant by remediating the flaw by no later than September 12, 2023.