CVE-2023-35082

9.8 criticalKEVEPSS 100%

Critical (9.8) in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. In CISA KEV since 2024-01-18, with known ransomware use. EPSS 100% chance of exploitation in the next 30 days.

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-01-18, due 2024-02-08, known ransomware use
CWE: CWE-287
Published: 2023-08-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ivanti:endpoint_manager_mobile

References

https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082

Check your stack JSON