CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-01-18
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-15 · updated 2026-06-17
Weakness: CWE-287

Description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Affected products

Ivanti Endpoint Manager Mobile (MobileIron): before 11.11.0 — fixed in 11.11.0

How to fix

Upgrade to a fixed version: Ivanti Endpoint Manager Mobile (MobileIron) 11.11.0. Check the vendor advisory for mitigations.

References

https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082

Get alerted when CVE-2023-35082 or the next vulnerability affects your stack