Ivanti EPMM (Endpoint Manager Mobile) Authentication Bypass and Remote API Access Vulnerability Advisory (CVE-2023-35078)
Executive & SecOps Summary
SECOPS ASSESSMENTIvanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) versions 11.4, 11.10, 11.11, and all older/supported releases
Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, allowing them to harvest sensitive personally identifiable information (PII) or create unauthorized administrative accounts
Immediately apply the official security patches or upgrade to Ivanti EPMM version 11.12 or higher, and restrict external access to administrative interfaces
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official RPM security updates provided by Ivanti or upgrade to the latest supported release (11.12 or higher). Access the Ivanti EPMM CLI and execute the following commands:
# Access Ivanti EPMM CLI and enter privileged mode
enable
# Check for available software updates and apply the patch
software update check
software update download
software update install
# Reboot the appliance to apply changes
reload2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict external access to the vulnerable /mifs API endpoints using an upstream reverse proxy or web application firewall (WAF).
# Example Nginx configuration to block external access to the vulnerable API path
server {
listen 443 ssl;
server_name epmm.company.com;
# Block external access to the vulnerable API endpoint
location ~* ^/mifs/aad/api/v/.* {
allow 10.0.0.0/8; # Allow trusted internal network only
deny all;
return 403 'Access Denied';
}
}3. Log Audit & IoC Verification Commands
Inspect the web server access logs for unauthorized requests targeting the /mifs/aad/api directory to identify potential exploitation attempts.
# Scan web server access logs for suspicious API requests returning HTTP 200
echo '[+] Scanning logs for CVE-2023-35078 exploitation attempts...'
grep -E '/mifs/aad/api/' /var/log/httpd/access_log | grep ' 200 ' | awk '{print $1, $4, $6, $7, $9}'
# Search for specific API calls related to user or configuration queries
grep -i 'aad/api' /var/log/httpd/access_log | grep -E '(user|admin|config)'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-35078) is a critical authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core). The root cause lies in an authentication validation flaw (CWE-287) within specific API endpoints. Due to improper path filtering and access control checks, the application fails to restrict unauthorized requests, allowing remote attackers to execute privileged API commands without valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending specially crafted HTTP requests to specific API paths, such as /mifs/aad/api/v2/. Because the application incorrectly processes these paths as public or exempt from authentication, the request bypasses security filters. Once bypassed, the attacker can query directory services, extract sensitive device registry details, retrieve user PII (usernames, emails, phone numbers), and potentially make configuration changes, including adding rogue administrative accounts to achieve persistent access.
3. Infrastructure & Business Impact
Ivanti EPMM serves as a centralized Mobile Device Management (MDM) gateway within enterprise networks. This vulnerability has been actively exploited in the wild and is listed on the CISA KEV catalog. Successful exploitation grants attackers a foothold inside the enterprise perimeter, enabling lateral movement, data exfiltration, and potential downstream compromise of enrolled mobile devices through malicious profile deployments.
Official Vendor Advisories & References
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
Frequently Asked SecOps Questions (CVE-2023-35078)
FAQQ1. How critical is CVE-2023-35078 and is it actively exploited in the wild?
CVE-2023-35078 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-35078?
Primary impacted vendors include ivanti across epmm, endpoint manager mobile. Scope summary: Ivanti Endpoint Manager Mobile (EPMM) versions 11.10, 11.11, 11.4, and all older/End-of-Life (EOL) versions
Q3. What temporary mitigations or workarounds exist for CVE-2023-35078 before patching?
[Mitigation] Immediately apply the official security patches or upgrade to Ivanti EPMM version 11.12 or higher, and restrict external access to administrative interfaces Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-35078
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ivanti)
View Category →Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)
[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.