CVE-2023-35082: Ivanti EPMM authentication bypass via unauthenticated API access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, and near-maximum EPSS make this an urgent patch-first item.

What it is

Ivanti Endpoint Manager Mobile (EPMM) 11.10 and older contains an authentication bypass that lets unauthenticated users reach restricted functionality and resources. It is a distinct flaw from CVE-2023-35078, so patching for that earlier issue alone does not cover this one. Because EPMM is a mobile device management server, bypassing authentication exposes a high-value control plane.

Impact

An attacker gains unauthenticated access to restricted application functionality and resources, with the CVSS vector indicating high confidentiality, integrity and availability impact. In an MDM context this can mean reaching managed-device and administrative data without credentials.

Attack surface

Reachable over the network through the application's API, per the vendor advisory title describing remote unauthenticated API access. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required.

Exploitation

Listed in CISA KEV since 2024-01-18 with known ransomware campaign use, and EPSS probability is 0.99999 (percentile 0.99996), indicating exploitation is both observed and highly likely. References are vendor advisories and the CISA KEV entry; no public exploit code is cited in the record.

What to do

• Apply the vendor's fix for CVE-2023-35082 per the Ivanti advisory; do not assume the CVE-2023-35078 patch covers it.
• If patching is not immediately possible, follow the vendor's stated mitigations or discontinue use of the product, as directed by the CISA KEV required action.
• Restrict network access to the EPMM/MobileIron Core management interface and API to trusted sources only.
• Rotate credentials and review administrative accounts and API keys on exposed EPMM instances for signs of unauthorized use.
• Confirm the deployed version is not 11.10 or older, since the record names that range as affected.

Detection

• Hunt web and API logs for unauthenticated requests to restricted EPMM endpoints, especially those returning success without a valid session.
• Alert on anomalous administrative actions, configuration changes or data exports from EPMM outside normal change windows.
• Monitor for exploitation indicators tied to CVE-2023-35082 and CVE-2023-35078 in network and host telemetry, given documented ransomware use.
• Review authentication logs for access to EPMM resources from unexpected source IPs or user agents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.