{"id":"CVE-2023-35078","published":"2023-07-25T07:15:10Z","modified":"2026-08-05T05:16:38Z","title":"Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability","vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","tier":"core","eol":null,"description":{"text":"An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.","provenance":"source","from":"NVD"},"summary":{"text":"An authentication bypass flaw in Ivanti Endpoint Manager Mobile (EPMM) lets unauthorized users reach restricted functionality and resources of the application without proper authentication. The attack vector indicates exploitation is possible over the network with low complexity, requiring no privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:39Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99998,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-07-25","dueDate":"2023-08-15","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-35078","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-07-24","exploitedFirstSeen":"2023-07-24","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078","date":"2023-07-24"},{"url":"https://nsm.no/aktuelt/nulldagssarbarhet-i-ivanti-endpoint-manager-mobileiron-core","date":"2023-07-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-07-25"},{"url":"https://sosintel.co.uk/flash-alert-cves-of-note-being-exploited-in-the-wild/","date":"2023-07-26"},{"url":"https://cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081","date":"2023-07-28"},{"url":"https://cisa.gov/news-events/alerts/2023/08/01/cisa-and-international-partner-ncsc-no-release-joint-cybersecurity-advisory-threat-actors-exploiting","date":"2023-08-01"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-213a","date":"2023-08-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2023-35078","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-35078","date":"2023-11-15"},{"url":"https://www.trellix.com/advanced-research-center/threat-reports/november-2023/","date":"2023-11-15"}],"evidenceTotal":1001,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability","tags":["Vendor Advisory"]},{"url":"https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability","tags":["Vendor Advisory"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability","tags":["Vendor Advisory"]},{"url":"https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. This enables them to extract personally identifiable information (PII) and perform administrative actions, such as creating new accounts and making configuration changes.","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise.","confidence":"high"},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an unauthenticated API access flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging the default internet-facing API configuration, allowing them to access restricted functionalities without authentication. Reports state attackers who exploited this vulnerability gained access personally identifiable information (PII) and added an administrator account on the affected EPMM server, to allow for further system compromise.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-39113","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39113","exploited":true,"exploitedSince":"2023-07-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2023-07-29","earliestUrl":"https://github.com/vaishnochaitanya/CVE-2023-35078-Exploit-POC","repos":[{"name":"vaishnochaitanya/CVE-2023-35078-Exploit-POC","url":"https://github.com/vaishnochaitanya/CVE-2023-35078-Exploit-POC","stars":115,"created":"2023-07-29"},{"name":"lager1/CVE-2023-35078","url":"https://github.com/lager1/CVE-2023-35078","stars":5,"created":"2023-07-29"},{"name":"raytheon0x21/CVE-2023-35078","url":"https://github.com/raytheon0x21/CVE-2023-35078","stars":5,"created":"2023-07-31"},{"name":"emanueldosreis/nmap-CVE-2023-35078-Exploit","url":"https://github.com/emanueldosreis/nmap-CVE-2023-35078-Exploit","stars":1,"created":"2023-08-01"},{"name":"0nsec/CVE-2023-35078","url":"https://github.com/0nsec/CVE-2023-35078","stars":1,"created":"2025-08-21"}]},"nuclei":[{"id":"CVE-2023-35078","name":"Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass","severity":"critical","path":"http/cves/2023/CVE-2023-35078.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35078.yaml"}],"first":{"date":"2023-07-29","source":"PoC-in-GitHub","url":"https://github.com/vaishnochaitanya/CVE-2023-35078-Exploit-POC"},"provenance":"source"},"exploitRefs":["https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1136","T1213"],"provenance":"source"}],"timeline":[{"date":"2023-07-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078","provenance":"source"},{"date":"2023-07-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35078","provenance":"source"},{"date":"2023-07-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-07-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39113","provenance":"source"},{"date":"2023-07-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/vaishnochaitanya/CVE-2023-35078-Exploit-POC","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1195 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}