CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

CVE-2023-35082 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. It allows unauthorized users to reach restricted functionality or resources without proper authentication. Because these products manage mobile devices and enterprise access, successful abuse can give attackers a foothold into device fleets, configuration data, and related infrastructure. CISA notes known ransomware use of this vulnerability, so rapid identification and remediation matter for any organization running the software.

How it works

The weakness is classified as CWE-287 (Improper Authentication). In products of this class, authentication checks that should gate access to administrative or sensitive interfaces fail under certain conditions. An attacker who can reach the affected service may bypass those checks and interact with restricted functionality or resources as if authenticated. Exact request patterns, endpoints, or preconditions are not detailed here; defenders must confirm the precise mechanics and any required conditions against the vendor advisory. The practical outcome is unauthorized access that can lead to further compromise of the mobile-device management environment.

Am I affected? How to find it in your systems

Ivanti EPMM (formerly MobileIron Core) typically runs as an on-premises or appliance-based mobile device management (MDM) platform that enrolls, configures, and secures corporate mobile devices. Inventory steps include:

• Search asset management, CMDB, and network discovery tools for hosts labeled Ivanti Endpoint Manager Mobile, EPMM, or MobileIron Core.
• Review internal documentation, purchase records, and virtualization inventories for MDM appliances or virtual machines running the product.
• Scan management networks and DMZs for the characteristic web interfaces and ports used by these products; confirm product identity via banners or administrative consoles where possible.
• Check installed versions and configurations against the ranges listed in the vendor advisory; specifics must be confirmed there because they are not provided in this summary.

For signs of exploitation, examine authentication and access logs for unexpected successful access to restricted resources from unauthenticated or unusual sources, anomalous administrative actions, or sudden changes to device enrollment or policy. Correlate with network telemetry showing connections to the management interface from unexpected external or internal hosts. Absence of clear indicators does not prove safety; treat any unpatched instance as potentially exposed.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation exactly as described in the Ivanti advisory for CVE-2023-35082. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After patching:

• Verify the update installed correctly and that the service restarts cleanly.
• Re-validate authentication controls and restrict administrative access to trusted networks and accounts only.
• Review and rotate any credentials or API keys that may have been accessible through the vulnerable interface.
• Harden the remaining surface: enforce least-privilege roles, enable multi-factor authentication where supported, and ensure management interfaces are not exposed to the public internet.

Document the change and re-scan to confirm the vulnerability is no longer present.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the EPMM/MobileIron Core host so that only authorized management stations and necessary internal systems can reach its interfaces; block all other inbound traffic at the firewall or network ACL.
• If a web application firewall or reverse proxy sits in front of the service, apply virtual-patching rules that deny unauthenticated access to sensitive paths once those paths are identified from the vendor advisory.
• Disable any non-essential features or remote-access options that enlarge the attack surface, provided doing so does not break critical operations.
• Increase monitoring: alert on failed and successful authentication events, unusual administrative actions, and new device enrollments; forward logs to a SIEM for correlation.
• If risk remains unacceptable and no mitigation is available, plan to take the product offline or replace it until a supported, patched version can be deployed.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities, especially those with known ransomware use, frequently lead to broader breaches. Assume that any unpatched instance reachable by an attacker may have been accessed. Review logs for indicators of compromise, isolate affected systems, and follow your incident-response plan, including credential resets and forensic preservation. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether related accounts appear in public dumps.