CVE-2023-35078

CVE-2023-35078: Ivanti EPMM Authentication Bypass (CVSS 9.8)

AI-generated analysis based on the vulnerability data on this page.

Summary

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, contains an authentication bypass vulnerability. A remote, unauthenticated attacker can access specific API endpoints that are intended to require authentication, effectively bypassing the product's access controls.

Background

Ivanti Endpoint Manager Mobile is a widely deployed mobile device management (MDM) platform used by enterprises to manage smartphones and tablets. Because MDM platforms typically sit at the network perimeter and hold elevated control over enrolled endpoints, a vulnerability in this layer has outsized impact across an organization's entire mobile fleet.

Root Cause — CWE-287: Improper Authentication

The vulnerability stems from improper authentication enforcement on one or more API endpoints. Under normal operation, these endpoints should validate session tokens or credentials before servicing requests. In affected versions, the authentication check is either missing or can be circumvented, allowing requests to proceed without a valid identity assertion. This is classified as CWE-287: Improper Authentication.

Impact

The CVSS v3 score of 9.8 reflects the worst-case scenario:

• Attack Vector (AV): Network — Exploitable remotely without local network access.
• Attack Complexity (AC): Low — No special conditions or race windows required.
• Privileges Required (PR): None — No authenticated account needed.
• User Interaction (UI): None — Fully automated, no victim action required.
• Scope (S): Unchanged — Impact stays within the vulnerable component.
• Confidentiality (C), Integrity (I), Availability (A): All High — Successful exploitation can expose sensitive MDM data, alter device policies, or disrupt mobile fleet operations.

Successful exploitation grants an attacker administrative-level API access to the MDM infrastructure, which can lead to full compromise of enrolled devices, exfiltration of corporate data, or deployment of malicious profiles.

Exploitation Walkthrough (Defensive Perspective)

Ethics Notice: This section is written for defenders, auditors, and incident responders. It does not contain working exploit code or step-by-step attack instructions.

The vulnerability is an authentication bypass against REST API endpoints. In a typical attack scenario:

1. The attacker identifies an exposed Ivanti EPMM management interface on the internet or an accessible network segment.
2. The attacker sends crafted HTTP requests to API endpoints that should require authentication.
3. Because the affected endpoints fail to enforce authentication, the requests are processed as if they came from a legitimate administrator.

From a defensive standpoint, this means any unauthenticated HTTP request to the EPMM API that returns non-error data or triggers state changes is a strong indicator of exposure. Security teams should treat internet-facing EPMM appliances as critical attack surface and verify that patches are applied before any exploitation scanning is observed.

Affected and Patched Versions

The following product is known to be affected according to NVD CPE data:

• Ivanti Endpoint Manager Mobile (EPMM) — specific version ranges were not provided in the source data at time of writing.

Administrators should consult Ivanti's official security advisories for exact patch levels:

• Ivanti Security Advisory
• Ivanti Knowledge Base

Remediation

1. Upgrade immediately. Ivanti has released security updates. Apply the vendor-recommended patch as soon as change control permits.
2. Restrict network access. Place EPMM management interfaces behind a VPN or on an isolated administrative network. Do not expose them directly to the internet.
3. Compensating controls. Until patching is complete, enforce IP allow-listing at the firewall or reverse-proxy layer for all EPMM API endpoints.
4. Review enrolled devices. After patching, audit device configurations and compliance states for signs of unauthorized policy changes.

Detection

• Monitor EPMM API access logs for requests to administrative endpoints from unexpected source IPs.
• Correlate internet-facing EPMM assets with vulnerability-scan results for CVE-2023-35078.
• Hunt for anomalous device policy modifications or bulk profile deployments that occurred shortly after the vulnerability's disclosure date (2023-07-25).
• Check CISA's KEV catalog and threat-intelligence feeds for active exploitation signatures.

Assessment

With an EPSS score of 0.99999 and confirmed inclusion in the CISA Known Exploited Vulnerabilities catalog on the same day as publication, CVE-2023-35078 sits in the highest tier of real-world risk. The combination of network exploitability, no privilege requirements, and high impact on a core enterprise infrastructure component makes this a must-patch vulnerability.

Key lessons:

1. Authentication must be enforced uniformly across every API surface, especially on perimeter-facing management platforms.
2. The speed of KEV inclusion (same-day) highlights the value of having an expedited patching track for critical, internet-exposed infrastructure.

References

• https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
• https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
• https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
• https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078