CVE-2023-35078: Ivanti EPMM authentication bypass via unauthenticated API access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network exploitation, KEV listing with known ransomware use, and near-maximum EPSS make this an urgent patch-first issue.

What it is

Ivanti Endpoint Manager Mobile (EPMM) contains an improper authentication flaw (CWE-287) that lets unauthenticated users reach restricted functionality and resources. The vulnerability is remotely reachable with no credentials or user interaction, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a live risk for internet-facing EPMM deployments.

Impact

An attacker gains unauthenticated access to restricted EPMM functionality and data, with high confidentiality, integrity and availability impact per the CVSS vector. Because EPMM manages mobile devices and enrollment, that access can expose or alter managed-device data and administrative functions.

Attack surface

Reached over the network via the EPMM API (CVSS AV:N/AC:L/PR:N/UI:N), so no authentication and no user interaction are required. Any EPMM instance exposing the affected interface to untrusted networks is in scope.

Exploitation

CISA added it to KEV on 2023-07-25 with a 2023-08-15 remediation due date and flags known ransomware campaign use; EPSS is 0.99999 (99.995th percentile), and vendor references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the Ivanti security updates for EPMM referenced in the vendor advisory as the first action.
• If patching cannot be done immediately, follow Ivanti's mitigation guidance or discontinue use of the product per CISA's required action.
• Remove EPMM management interfaces from direct internet exposure and restrict access to trusted networks or VPN.
• Review EPMM logs and configuration for unauthorized API access or changes made before patching.
• Rotate credentials and API keys that may have been exposed through unauthenticated access.

Detection

• Hunt EPMM/web server logs for unauthenticated requests to restricted API endpoints, especially anomalous paths or methods returning 200.
• Alert on API access from unexpected source IPs or user agents, and on requests outside normal administrative patterns.
• Monitor for new or modified EPMM administrative accounts, configuration changes, or device enrollment activity outside change windows.
• Correlate EPMM logs with network egress for data access or exfiltration following suspicious API calls.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.