CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Description
CVE-2023-35078 is a critical authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows unauthorized users to access restricted functionality and resources without proper authentication. With a CVSS score of 9.8 (Critical), this Ivanti EPMM security flaw enables unauthenticated remote attackers to access the administrative API, potentially gaining full control over the mobile device management platform and all managed devices. CISA has confirmed active exploitation of CVE-2023-35078 in the wild and has identified its association with ransomware campaigns. The EPSS score of 94.5% (99th percentile) places this among the most actively exploited vulnerabilities currently tracked, demanding immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | < 11.8.1.1; >= 11.9.0, < 11.9.1.1; >= 11.10, < 11.10.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability(Vendor Advisory)
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078(Exploit, Vendor Advisory)
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078(Third Party Advisory, US Government Resource)
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
In the context of CVE-2023-35078, the improper authentication weakness in Ivanti EPMM allows remote attackers to completely bypass the application's authentication mechanisms and access API endpoints that should require valid credentials. The application fails to properly verify the identity of users before granting access to restricted administrative functions, enabling unauthenticated access to sensitive management capabilities.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2023-35078 carries a CVSS 3.1 base score of 9.8 (Critical severity), representing the highest tier of vulnerability impact. Attack Vector (Network): The vulnerability is remotely exploitable from anywhere on the internet without physical access, making every internet-exposed Ivanti EPMM instance a potential target. Attack Complexity (Low): Exploitation is trivial with no special conditions, timing, or configuration needed. Privileges Required (None): No authentication whatsoever is needed — any attacker can exploit this vulnerability without valid credentials. User Interaction (None): No action from a legitimate user is required, enabling fully automated exploitation. Impact (Confidentiality, Integrity, Availability — all High): Successful exploitation grants access to the EPMM administrative API, enabling an attacker to read personally identifiable information (PII), modify device configurations, deploy malicious profiles to managed mobile devices, and disrupt the entire mobile device management infrastructure. Ransomware association: CISA has confirmed that CVE-2023-35078 is associated with known ransomware campaigns, significantly elevating the risk for affected organizations. The EPSS score of 94.5% (99th percentile) confirms near-certain active exploitation across the threat landscape.
Exploit Maturity
CVE-2023-35078 is confirmed as actively exploited in the wild with a mature exploitation landscape. CISA added this Ivanti EPMM authentication bypass to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 15, 2023, and has confirmed its use in ransomware campaigns. Public exploit information is available through the Ivanti advisory and knowledge base, which is tagged as containing exploit details. The EPSS score of 94.5% (99th percentile) indicates near-certain exploitation activity. Chaining potential: CVE-2023-35078 is frequently chained with CVE-2023-35081, a path traversal vulnerability in the same Ivanti EPMM product — the authentication bypass from CVE-2023-35078 eliminates the administrator credential requirement for CVE-2023-35081, enabling unauthenticated arbitrary file writes and full system compromise.
Remediation
- Apply vendor patches immediately as the highest priority — Upgrade Ivanti Endpoint Manager Mobile (EPMM) to the latest patched version as directed by Ivanti's security advisory. Given the critical severity (CVSS 9.8), ransomware association, and trivial exploitability, this vulnerability should be treated as an emergency patch. If patching is not immediately possible, discontinue use of the product as directed by CISA.
- Isolate EPMM from the internet — Immediately remove Ivanti EPMM from direct internet exposure. Place the appliance behind a VPN or reverse proxy that requires authentication before reaching the EPMM interface. Apply firewall rules to restrict access to trusted management networks only.
- Address related vulnerabilities in the chain — Ensure CVE-2023-35081 (path traversal) is also patched, as these two vulnerabilities are commonly exploited together. The combination of authentication bypass and arbitrary file write enables complete system compromise.
- Conduct a thorough compromise assessment — Review EPMM access logs for unauthorized API calls, particularly to administrative endpoints. Check for unauthorized device enrollments, modified device profiles, or deployed configurations. Inspect the appliance filesystem for signs of web shells or unauthorized files (indicators of CVE-2023-35081 chaining). Reset all administrative credentials.
- Implement API security hardening — Deploy API gateway or WAF rules to monitor and restrict access to EPMM API endpoints. Enable detailed API access logging and alerting for unusual authentication patterns. Implement rate limiting on authentication endpoints to slow automated exploitation attempts.
Technical Details
CVE-2023-35078 exploits an improper authentication weakness (CWE-287) in the Ivanti Endpoint Manager Mobile (EPMM) API layer, where specific API endpoints fail to enforce authentication checks, allowing unauthenticated remote access to administrative functions. Vulnerability mechanism: The application's authentication logic contains a bypass that permits direct access to restricted API endpoints without presenting valid credentials. This is not a misconfiguration but a flaw in the authentication implementation itself, where certain request paths or parameters circumvent the authentication middleware entirely. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability profile — network-accessible, low complexity, no privileges, no user interaction — combined with maximum impact across confidentiality, integrity, and availability. Exploitation scope: Through the unauthenticated API access, an attacker can enumerate and extract PII of managed device users, modify device management policies, push malicious configurations to enrolled mobile devices, and when chained with CVE-2023-35081, achieve arbitrary file writes leading to remote code execution on the EPMM server itself.
Frequently Asked Questions
Is CVE-2023-35078 being actively exploited?
Yes, CVE-2023-35078 is confirmed as actively exploited in the wild and is associated with ransomware campaigns. CISA added this Ivanti EPMM authentication bypass to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 15, 2023. The EPSS score of 94.5% (99th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2023-35078?
CVE-2023-35078 affects Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. All versions of Ivanti EPMM are potentially affected until the vendor patch is applied. Organizations using this mobile device management platform should verify their version and patch status immediately.
How do I fix CVE-2023-35078?
Upgrade Ivanti EPMM to the latest patched version as directed by Ivanti's security advisory. Immediately remove the EPMM instance from direct internet exposure and restrict access to trusted networks. Also patch CVE-2023-35081 as these vulnerabilities are commonly chained. Conduct a compromise assessment of your environment.
How severe is CVE-2023-35078?
CVE-2023-35078 has a CVSS 3.1 base score of 9.8 (Critical severity), the highest practical severity rating. With no authentication required, trivial exploitation complexity, and confirmed ransomware association, this is among the most dangerous vulnerabilities in the current threat landscape. The EPSS score of 94.5% (99th percentile) indicates near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.