CVE-2023-35078: Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

CVE-2023-35078 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM), previously known as MobileIron Core. It allows unauthenticated access to specific API paths on a vulnerable system.

This matters because an attacker who reaches those paths can obtain personally identifiable information such as names, phone numbers, and other mobile device details, and can also make configuration changes including installing software and modifying security profiles on registered devices. The vulnerability has known ransomware use, so organizations running EPMM should treat discovery and remediation as high priority.

How it works

The flaw is classified as CWE-287 (improper authentication). In practice, the product fails to enforce authentication properly on certain API paths. An attacker with network access to a vulnerable EPMM instance can therefore interact with those paths without valid credentials. Once there, the attacker can read PII belonging to users and devices managed by the system, and can issue configuration changes that affect registered mobile endpoints. Exact API paths, request formats, and any additional preconditions are not detailed in the available summary; defenders must confirm those specifics against the vendor advisory rather than relying on general descriptions of this weakness class.

Am I affected? How to find it in your systems

Ivanti EPMM (and its earlier MobileIron Core branding) is typically deployed as an on-premises or privately hosted mobile device management server that enrolls and controls enterprise smartphones and tablets. It is commonly found in environments that centralize mobile policy, app distribution, and device inventory.

• Inventory all servers and virtual appliances running Ivanti Endpoint Manager Mobile or MobileIron Core; check asset management databases, CMDB entries, and network scans for the product name or related management ports.
• Compare installed versions and configurations against the vendor advisory for CVE-2023-35078; exact affected version ranges are not provided here and must be verified directly with Ivanti guidance.
• Identify whether the management interface or API endpoints are reachable from untrusted networks, the internet, or broad internal segments.
• Review application and access logs for unauthenticated requests to API paths, unexpected retrieval of user or device records, or configuration changes (software installs, security profile modifications) that lack corresponding administrator activity.
• Correlate any such activity with external threat intelligence or ransomware indicators, given the known ransomware association.

How to remediate

The primary action is to apply the mitigations or updates published by the vendor. CISA’s required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable.

• Obtain and install the vendor-supplied fix or configuration changes named in the official Ivanti advisory for this CVE; confirm the exact package or procedure against that advisory.
• After patching, re-validate that previously exposed API paths now require authentication and that unauthorized configuration changes are blocked.
• For the broader authentication-bypass class, enforce least-privilege access to the management plane, require multi-factor authentication for administrative sessions, and restrict API exposure to only necessary internal networks.
• Document the remediation steps and retain evidence of version or configuration changes for audit and compliance purposes.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls that limit reachability and increase detection.

• Segment the EPMM server so that its management and API interfaces are reachable only from tightly controlled administrative networks; block direct internet or broad LAN access.
• Deploy virtual patching or web-application firewall rules that deny unauthenticated requests to the API paths described in the vendor advisory (once those paths are confirmed).
• If the product allows it, temporarily disable or restrict the affected API functionality or related mobile-management features until a permanent fix is in place.
• Increase monitoring and alerting on authentication failures, anomalous API traffic, sudden changes to device inventories, software installations, and security-profile modifications; feed these signals into the security operations center for rapid response.
• Prepare an isolation and rebuild plan in case compromise indicators appear, given the ransomware association.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities of this type can result in unauthorized access to PII and subsequent ransomware activity. If logs or other evidence suggest the vulnerable APIs were reached, treat the incident as a potential breach: preserve forensic data, notify appropriate internal stakeholders, and follow your organization’s incident-response and regulatory notification procedures. Individuals concerned about personal exposure can run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in public breach collections.