CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Description
CVE-2023-35082 is a critical authentication bypass vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, in versions 11.10 and older. The flaw allows unauthenticated remote attackers to access restricted API endpoints and application resources without any credentials, achieving full compromise of confidentiality, integrity, and availability. With a CVSS v3.1 score of 9.8 and an EPSS score above 0.94, this vulnerability carries an extremely high likelihood of active exploitation in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog, noting ransomware association, and mandated remediation by February 8, 2024. Organizations running unpatched versions of Ivanti EPMM face immediate risk of complete system compromise and should apply vendor-provided mitigations or discontinue use without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | < 11.11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Weakness Type
CWE-287: Improper Authentication
CVE-2023-35082 is classified under CWE-287: Improper Authentication. This weakness occurs when a system does not adequately verify that a claimed identity is correct before granting access to protected resources or functionality.
In this case, Ivanti EPMM fails to enforce authentication checks on certain API endpoints, allowing attackers to bypass the login process entirely. The root cause lies in logic flaws in how the application validates incoming requests — specific paths can be accessed without presenting valid credentials. This is distinct from but related to CVE-2023-35078, which targeted the same product family; CVE-2023-35082 represents a separate, unique bypass path discovered subsequently.
Impact Analysis
Confidentiality Impact (HIGH): An unauthenticated attacker can retrieve sensitive device management data, user information, and configuration details stored within the EPMM platform, potentially exposing corporate credentials and personally identifiable information.
Integrity Impact (HIGH): By accessing restricted API functionality without authentication, an attacker may be able to modify device configurations, enroll rogue devices, or alter management policies across the entire mobile device fleet managed by the platform.
Availability Impact (HIGH): Unauthorized access to administrative functions can disrupt the EPMM service, remove enrolled devices from management, or render the platform inoperable, affecting enterprise mobility management capabilities organization-wide.
Scope: The vulnerability does not require any privileges or user interaction, operating entirely over the network with low attack complexity. This combination of factors — network-accessible, no authentication, no user interaction — places this vulnerability at the highest tier of exploitability. The known ransomware association recorded in the KEV catalog underscores the severity of real-world impact.
Exploit Maturity
Exploitation Status: CVE-2023-35082 has been confirmed as actively exploited in the wild. Its inclusion in CISA's Known Exploited Vulnerabilities catalog reflects documented exploitation by threat actors.
Ransomware Association: The KEV catalog explicitly flags this vulnerability as associated with ransomware campaigns, significantly elevating the risk profile for affected organizations.
EPSS Score: With an EPSS score of 0.9442 (94th percentile — 99.98th), the statistical likelihood of exploitation is extremely high relative to all known CVEs. This places CVE-2023-35082 among the top 0.02% of vulnerabilities by exploitation probability.
Attack Complexity: The attack requires no privileges, no user interaction, and is exploitable over the network with low complexity, making it trivially accessible to a wide range of threat actors including less sophisticated attackers.
Relation to CVE-2023-35078: This vulnerability is noted to be unique to and separate from CVE-2023-35078, indicating that patching the earlier vulnerability alone is insufficient to protect against this bypass path.
Remediation
- Apply vendor patches immediately: Follow Ivanti's guidance published in the vendor advisory at forums.ivanti.com. Ivanti released patches addressing CVE-2023-35082 for EPMM and MobileIron Core — apply the latest available update without delay.
- Discontinue use if patching is not possible: Per CISA's KEV required action, if mitigations cannot be applied, organizations should discontinue use of the affected product to prevent exploitation.
- Verify patch applicability: Confirm that the installed version (11.10 and older are affected) falls within the patched release range specified in the vendor advisory.
- Restrict network access: Until patching is complete, restrict external network access to the EPMM management interface using firewall rules or network segmentation to limit exposure.
- Audit API access logs: Review logs for unauthorized or anomalous access to restricted API endpoints that may indicate prior exploitation.
- Rotate credentials and tokens: If exploitation is suspected or confirmed, rotate all credentials, certificates, and API tokens associated with the EPMM platform.
- Monitor for indicators of compromise: Check for signs of lateral movement, ransomware precursor activity, or data exfiltration, given the known ransomware association of this CVE.
Technical Details
Vulnerability Class: Authentication bypass via improper enforcement of access controls on API endpoints in Ivanti EPMM (formerly MobileIron Core).
Affected Versions: Ivanti Endpoint Manager Mobile (EPMM) version 11.10 and all older releases, including legacy MobileIron Core deployments.
Attack Vector: Network (AV:N) — the vulnerability is remotely exploitable without any physical or adjacent-network access requirement.
Authentication Required: None (PR:N) — no credentials or session tokens are needed to trigger the bypass.
Mechanism: The application fails to enforce authentication checks on certain API routes. A specially crafted unauthenticated HTTP request can reach functionality that should be restricted to authenticated administrators. This is a distinct code path from CVE-2023-35078 and requires separate remediation.
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — all impact dimensions rated HIGH, attack complexity LOW, no user interaction required.
CWE Classification: CWE-287 (Improper Authentication) — the application fails to sufficiently verify the identity of users accessing restricted resources.
KEV Designation: Listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of 2024-02-08 and a confirmed ransomware association.
Frequently Asked Questions
Is CVE-2023-35082 the same as CVE-2023-35078?
No. While both vulnerabilities affect Ivanti EPMM and involve authentication bypass, they are distinct and separate issues. CVE-2023-35082 represents a unique bypass path that is explicitly noted to be different from the earlier CVE-2023-35078. Organizations that patched CVE-2023-35078 are still vulnerable to CVE-2023-35082 unless they apply the specific remediation for this CVE.
Which versions of Ivanti EPMM are affected?
All versions of Ivanti Endpoint Manager Mobile (EPMM) up to and including version 11.10 are affected. This also covers the product under its previous name, MobileIron Core. Organizations should consult the vendor advisory to identify the exact fixed version and upgrade accordingly.
Has CVE-2023-35082 been exploited in ransomware attacks?
Yes. CISA's Known Exploited Vulnerabilities catalog explicitly associates CVE-2023-35082 with ransomware activity. The extremely high EPSS score of 0.9442 further confirms that exploitation is widespread. Organizations running affected versions should treat this as an emergency requiring immediate remediation.
What can an attacker do if they exploit CVE-2023-35082?
A successful attacker can access restricted API endpoints and application resources without authentication, effectively gaining unauthorized administrative access to the EPMM platform. This allows them to read sensitive data, modify device management policies, enroll rogue devices, and potentially use the platform as a pivot point for broader network compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.