Security readout for executives and security teams
Plain-English summary
Ivanti Endpoint Manager Mobile versions 11.8, 11.9, and 11.10 contain a critical authentication bypass. A remote, unauthenticated attacker may access restricted application functions or resources, creating serious confidentiality, integrity, and availability risk. CISA lists the vulnerability as known exploited, making exposed or unremediated systems an immediate business concern.
Executive priority
Immediate. Assign accountable owners to inventory, remediate, and investigate affected EPMM deployments. Prioritise internet-reachable systems and confirm completion with evidence. Because CISA records known exploitation and the vulnerability requires no credentials or user action, delay materially increases the chance of compromise.
Technical view
CVE-2023-35078 is a CWE-287 authentication bypass affecting Ivanti EPMM 11.8, 11.9, and 11.10. Its CVSS 3.0 score is 10.0: network-accessible, low complexity, requiring neither privileges nor user interaction, with changed scope and high potential impact across confidentiality, integrity, and availability.
Likely exposure
Organisations running the listed EPMM versions are affected. Risk is greatest where the vulnerable application or API is reachable from untrusted networks. The supplied evidence does not establish which individual deployments are internet-accessible, patched, or otherwise protected.
Exploitation context
Active exploitation is supported by CISA's Known Exploited Vulnerabilities catalog. The supplied sources do not describe exploitation volume, specific victims, attacker groups, or observed techniques, so those details should not be inferred.
Researcher notes
The source bundle establishes authentication bypass, affected versions, a 10.0 CVSS vector, and KEV status. It does not provide fixed-version numbers, indicators of compromise, exploit-chain details, or deployment-specific exposure. Validation should therefore combine version and update checks, reachability assessment, access-control testing, and log review without treating absent alerts as proof of safety.
Mitigation direction
- Identify every deployment running Ivanti EPMM 11.8, 11.9, or 11.10.
- Apply the applicable Ivanti security update using current vendor guidance.
- Restrict untrusted network access until remediation is confirmed.
- Prioritise investigation of externally reachable or previously exposed systems.
- Review Ivanti and CISA guidance for updated remediation information.
Validation and detection
- Verify deployed EPMM versions against the affected version list.
- Confirm the vendor security update is installed on every instance.
- Test that restricted application resources reject unauthenticated requests.
- Review relevant access and security logs for unexplained unauthenticated activity.
- Confirm network controls prevent unnecessary access from untrusted sources.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-35078 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96hackeroneVulnerability scoring details
Base CVSS 3.0 score
10CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2023-35078 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2023-07-25T00:00:00.000Z: CVE-2023-35078 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerabilityCVE reference, hackerone
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078CVE reference, hackerone
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078CVE reference, hackerone
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerabilityCVE reference, hackerone
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.