CVE-2023-35078: Ivanti EPMM (MobileIron) authentication bypass, actively exploited
The short version: CVE-2023-35078 is an authentication bypass in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) that lets an unauthenticated attacker reach restricted API endpoints — reading and modifying data on a server that manages your mobile fleet. It scores a perfect 10.0, it was exploited in the wild, and it's in CISA's KEV catalog with known ransomware-campaign use. If you run an internet-facing EPMM, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated access to a mobile-device-management server |
| CVSS v3.0 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-08-15 |
| Known exploited? | Yes — exploited in the wild; KEV notes known ransomware-campaign use |
| Vulnerability type | Authentication bypass → unauthenticated access to restricted API functionality |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ivanti EPMM 11.10 and earlier (including older MobileIron Core releases) |
| Fixed in | 11.8.1.1 · 11.9.1.1 · 11.10.0.2 (and later) |
What you need to know
CVE-2023-35078 is a flaw in how EPMM's web layer gates access. Certain API paths that should require authentication don't, so an unauthenticated attacker can call them directly — reading personally identifiable information about users and devices, and reaching administrative functionality.
Why it belongs at the top of the queue:
- It's pre-authentication and network-reachable. No credentials, no chain required.
- The target manages your mobile fleet. EPMM holds device inventory, user data, and administrative control over enrolled phones and tablets — a rich target and a launch point.
- It was chained and exploited. It was used together with a related path-traversal bug and exploited in the wild, including against government targets; CISA flags ransomware-campaign use.
How serious we see it
High — the 10.0 is not hyperbole here.
Unauthenticated, network-reachable access to a mobile-device-management server, confirmed exploited in the wild, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific EPMM builds, the fixes are published, and exposure is quick to determine. Because it was a pre-patch and mass-exploited flaw, treat an exposed, unpatched EPMM as potentially compromised.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Upgrade to 11.8.1.1 / 11.9.1.1 / 11.10.0.2 or later.
- Hunt for compromise. Review EPMM access logs for unauthenticated hits on protected API paths, given the exploitation history.
- If compromised, respond fully. Rotate credentials, keys, and tokens, and investigate for data access and lateral movement.
- Harden exposure. Restrict who can reach the EPMM interface; keep administrative access off the public internet.
- Confirm your exposure first. Verify whether you run an internet-facing EPMM and which version.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti EPMM interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view is the point: when a management-server bug breaks, the exposed EPMM is already mapped, so you go straight to patch-and-verify.