CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-35078
Critical (9.8) in Ivanti Endpoint Manager Mobile (EPMM). In CISA KEV since 2023-07-25, with known ransomware use. EPSS 100% chance of exploitation in the next 30 days.
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-07-25, due 2023-08-15, known ransomware use
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ivanti:endpoint_manager_mobile
References
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability