CVE-2023-41724 is a high severity (CVSS 8.8) command injection flaw in Ivanti Standalone Sentry before version 9.19.0. An unauthenticated attacker on the same physical or logical network could run arbitrary commands on the appliance. Upgrade to 9.19.0 or later and read the Ivanti advisory for any extra steps.
What's affected
The NVD record says Ivanti Standalone Sentry prior to 9.19.0 is affected, so 9.19.0 is the first release outside the range. The record states the attacker is unauthenticated and sits within the same physical or logical network as the appliance, which matches the adjacent attack vector.
The Ivanti advisory page is rendered by script and returned no readable text to our automated request, so we could not confirm anything beyond the record. Check the advisory for supported upgrade paths and for any related Sentry issues.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be reached from an adjacent network (the same physical or logical network), the attack complexity is low, it requires no privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness classes are CWE-77 (command injection) and CWE-94 (code injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the Standalone Sentry admin portal and read the installed version from the system or about page. Anything before 9.19.0 is in scope.
Then map the network position. The attacker needs to be on the same network segment, so check which networks can reach the Sentry, including guest, partner and device networks, and whether those can be limited.
What to do now
- Find every Ivanti Standalone Sentry appliance and record its version.
- Upgrade to 9.19.0 or later, following the Ivanti advisory.
- Segment the appliance so only the networks that need it can reach it.
- Watch the appliance logs for unexpected command activity after the upgrade.
Why it matters
The weaknesses are CWE-77, command injection, and CWE-94, code injection. Input is passed into a command or code path without being neutralised, so the sender can decide what the appliance runs. The vector shows no privileges, no user interaction and high impact on all three areas, limited only by the adjacent network requirement.
Sentry sits between mobile devices and internal systems, so a compromised appliance is a strong pivot. The adjacent attack path lowers the score from critical, but internal segmentation then becomes the main control. The record does not flag this CVE as being in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need credentials?
No. The record calls the attacker unauthenticated. They do need to be on the same physical or logical network.
Which version fixes it?
Ivanti Standalone Sentry 9.19.0 and later, according to the record. Confirm in the Ivanti advisory.
Sources
- Ivanti advisory for CVE-2023-41724 (linked from the NVD record; the page returned no readable text when we reviewed it)
- CVE-2023-41724 on Gold
Last reviewed: 19 October 2026.
