CVE-2023-35081: Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

CVE-2023-35081 is a path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM). It allows an authenticated administrator to perform malicious file writes on the EPMM server. When combined with CVE-2023-35078, it can help bypass authentication and ACL restrictions where those apply. For organizations running EPMM as a mobile device management platform, this matters because successful abuse can let an attacker place files on the server and potentially expand control over managed endpoints and the management plane itself.

Defenders should treat this as a high-priority issue for any EPMM deployment until the vendor's fixed release is confirmed and applied. Specifics such as exact affected builds must be verified against the official Ivanti advisory.

How it works

The underlying weakness is CWE-22 (path traversal). In this class of flaw, insufficient validation of user-supplied path information lets an attacker reach locations outside the intended directory. According to the CISA summary, an authenticated administrator can exploit the issue to write malicious files to the EPMM server. The same summary notes that the vulnerability can be used together with CVE-2023-35078 to bypass authentication and ACL restrictions if those controls are present. No further exploit mechanics, payloads, or version-specific details are provided here; teams must consult the vendor advisory for the precise attack surface and conditions.

In practical terms, once an attacker has (or obtains) administrator-level access, the path-traversal write capability can be used to drop files that alter server behavior, plant persistence, or prepare further stages. Chaining with the companion authentication-bypass issue removes the need for legitimate credentials in some scenarios, increasing the risk of unauthenticated or lightly authenticated compromise of the management server.

Am I affected? How to find it in your systems

Ivanti EPMM is typically deployed as an on-premises or appliance-based mobile device management solution that manages mobile devices, applications, and policies across an enterprise. Inventory every instance of EPMM in your environment—production, staging, and any management consoles reachable from internal or external networks.

• Query asset inventories, CMDB records, and network discovery tools for hosts running Ivanti Endpoint Manager Mobile or its predecessor branding.
• Confirm the installed software version and build against the list of affected releases published in the vendor advisory; do not rely on assumptions about version ranges.
• Review administrative accounts and authentication configuration, because the flaw requires (or can be chained to obtain) administrator privileges.
• Examine web-server and application logs for unusual file-write activity, unexpected path patterns containing directory-traversal sequences, or administrative actions that coincide with anomalous file creation outside normal application directories.
• Check for signs of the companion CVE-2023-35078 (authentication/ACL bypass) in the same logs, as the two issues are known to be usable together.

If EPMM is internet-facing or reachable from untrusted networks, prioritize those instances for immediate review.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2023-35081. Follow Ivanti’s instructions exactly; CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After patching, verify the new version is running and re-test administrative functions to ensure normal operation.

• Restrict administrative access to EPMM to a minimal set of trusted accounts and networks.
• Enforce strong authentication (preferably multi-factor) for all administrative interfaces.
• Harden the host and application according to Ivanti’s security guidance, including least-privilege file-system permissions and regular integrity checks of critical directories.
• Remove or disable any unused administrative features that accept path or file parameters.

Document the change and retain evidence of the patch level for compliance and incident-response purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls. Segment the EPMM server so that only authorized management workstations and jump hosts can reach its administrative interfaces. Place a web application firewall or reverse-proxy filter in front of the service and apply virtual-patching rules that block known path-traversal patterns and unexpected file-write requests; tune these rules carefully to avoid breaking legitimate administrative workflows. Disable any non-essential features that accept file or path input if the product configuration allows it. Increase monitoring of authentication events, file-system changes on the EPMM host, and outbound connections from the server. If the risk remains unacceptable and no mitigations are available, follow CISA guidance and consider discontinuing use of the product until a fix can be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type frequently lead to broader compromise of the management server and the devices it controls. If you suspect exploitation, isolate the affected EPMM instance, preserve logs and disk images, and begin incident-response procedures. Review any files written outside expected locations and check for follow-on activity. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization have already appeared in public breach collections.