CVE-2023-35082
Published 2023-08-15 · Updated 2026-06-17 · Source support@hackerone.com
Summary
CVE-2023-35082 is a critical-severity (CVSS 9.8) vulnerability in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 8, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Ivanti has 38 vulnerabilities in the KEV catalog, 12 of them linked to ransomware.
All 38 known-exploited Ivanti vulnerabilities →Description
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Ivanti — Endpoint Manager Mobile (EPMM) and MobileIron Core
Name: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Date added: 2024-01-18 · Due: 2024-02-08
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
References
- https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
- https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082