What’s Vulnerable › Vulnerabilities

CVE-2023-35078: Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-07-25
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-25 · updated 2026-08-05
• Weakness: CWE-287

Description

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Affected products

• Ivanti Endpoint Manager Mobile (MobileIron): before 11.8.1.1; from 11.9.0 before 11.9.1.1; from 11.10 before 11.10.0.2 — fixed in 11.10.0.2, 11.8.1.1, 11.9.1.1

How to fix

Upgrade to a fixed version: Ivanti Endpoint Manager Mobile (MobileIron) 11.10.0.2, 11.8.1.1, 11.9.1.1. Check the vendor advisory for mitigations.

References

• https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
• https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
• https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
• https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
• https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
• https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
• https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
• https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078

Get alerted when CVE-2023-35078 or the next vulnerability affects your stack