Ivanti EPMM (Endpoint Manager Mobile) Path Traversal and Arbitrary File Write Vulnerability (CVE-2023-35081) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTIvanti EPMM versions 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, and 11.8.x < 11.8.1.2
An authenticated administrator can write arbitrary files to the appliance via path traversal, potentially leading to Remote Code Execution (RCE)
Immediately apply the official security patches provided by the vendor and restrict external access to the admin portal
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Ivanti EPMM appliance to the patched versions (11.10.0.3, 11.9.1.2, or 11.8.1.2) via the administrator CLI.
# Verify the current running version of EPMM
show version
# Execute the system update to apply the latest security patch
software update image
software update reboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the administrative portal (typically port 8443) using a firewall or reverse proxy. Below is an example of restricting access using Nginx:
# Restrict access to the administrative interface (/mifs/admin)
server {
listen 443 ssl;
server_name epmm.company.local;
location /mifs/admin {
allow 10.0.0.0/8; # Allow trusted internal admin subnet
allow 192.168.1.0/24;
deny all; # Block all other external traffic
proxy_pass https://backend_epmm;
}
}3. Log Audit & IoC Verification Commands
Inspect web server logs for directory traversal patterns and audit the web directory for unauthorized JSP files.
# Search for directory traversal patterns in Tomcat and HTTP logs
grep -i '\.\./' /var/log/httpd/*access_log
grep -i '\.\./' /var/log/tomcat/*
# Scan the webapps directory for recently modified or created JSP files
find /usr/local/tomcat/webapps/ -name '*.jsp' -mtime -30 -lsStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-35081) is a path traversal flaw (CWE-22) within specific API endpoints of Ivanti EPMM (formerly MobileIron Core). Due to insufficient input validation on file upload parameters, an authenticated user with administrative privileges can write arbitrary files to any directory on the appliance's filesystem.
2. Exploitation Mechanics & Attack Scenario
An attacker with administrative access—or one who bypasses authentication by chaining this with other vulnerabilities like CVE-2023-35078—can craft a malicious file upload request. By injecting directory traversal sequences (e.g., '../') into the file path parameter, the attacker bypasses the intended upload directory restrictions. This allows them to write a malicious JSP web shell directly into the web root directory, enabling arbitrary OS command execution.
3. Infrastructure & Business Impact
Since Ivanti EPMM serves as a centralized mobile device management (MDM) controller, compromise of this platform grants attackers deep access to the internal network and enrolled mobile devices. This vulnerability is actively exploited in the wild (CISA KEV listed) and carries a high EPSS score of 0.6358, posing an immediate threat to enterprise infrastructure.
Official Vendor Advisories & References
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
Frequently Asked SecOps Questions (CVE-2023-35081)
FAQQ1. How critical is CVE-2023-35081 and is it actively exploited in the wild?
CVE-2023-35081 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 63.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-35081?
Primary impacted vendors include ivanti across epmm, endpoint manager mobile. Scope summary: Ivanti EPMM (Endpoint Manager Mobile) 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2
Q3. What temporary mitigations or workarounds exist for CVE-2023-35081 before patching?
[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to the admin portal Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-35081
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ivanti)
View Category →Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)
[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.