CVE DatabaseCVE-2023-35082

Updated 2026-06-17한국어 권고문 →

CVE-2023-350829.8/CRITICALCISA KEVCWE-287

Ivanti EPMM (formerly MobileIron Core) Authentication Bypass and Remote Code Execution Vulnerability (CVE-2023-35082) Urgent Security Advisory

⚡ Jump to Patch

Affected Vendors

ivanti

Affected Components

epmm, mobileiron_core

Published Date

2023-08-15

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti EPMM (Endpoint Manager Mobile) 11.10 and older, and MobileIron Core 11.2 and older

Impact

Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, compromise sensitive data, or execute arbitrary commands

Mitigation

Immediately upgrade to the latest supported release and restrict external access to administrative API endpoints

Affected Products & Version Scope

Ivanti EPMM versions 11.10, 11.9, 11.8, 11.7 and older, and MobileIron Core versions 11.2 and older

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Ivanti recommends immediately upgrading all affected instances to a supported, patched version (11.11 or later) or applying the vendor-provided hotfix.

bash

# Example commands to check and install updates via Ivanti EPMM CLI
enable
software update check
software update install
# Reboot the appliance to clear active sessions and apply changes
reload

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the EPMM administrative portal and API paths ('/mifs') using a firewall or reverse proxy, allowing access only from trusted internal IP ranges.

nginx

# Example Nginx configuration to block external access to vulnerable API paths
server {
    listen 443 ssl;
    server_name epmm.company.local;

    # Restrict access to vulnerable API endpoints
    location ~* ^/mifs/(aad|services)/ {
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        deny all;
        proxy_pass https://backend_epmm;
    }
}

3. Log Audit & IoC Verification Commands

Inspect web server access logs for unauthorized requests targeting the '/mifs/' directory that returned an HTTP 200 status code from external IP addresses.

bash

# Search access logs for potential authentication bypass attempts
grep -E '/mifs/aad/|/mifs/services/' /var/log/httpd/access_log | grep -v '127.0.0.1' | awk '$9 == "200" {print $1, $4, $7, $9}'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As this vulnerability is actively exploited in the wild, immediately verify the patch level of all internet-facing Ivanti EPMM appliances and apply the latest security updates.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2023-35082 is a critical authentication bypass vulnerability (CWE-287) residing in Ivanti EPMM (formerly MobileIron Core). The root cause lies in a logical flaw within the application's routing and authentication filter chain. Certain API endpoints fail to properly validate the authentication state of incoming HTTP requests, allowing remote attackers to bypass security controls entirely.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests directly to exposed API paths (such as '/mifs/aad/...' or other internal endpoints). Because the authentication filter fails to intercept and validate these requests, the application processes them with administrative privileges. This bypass can be chained with other functionalities to upload web shells, modify configurations, or achieve remote code execution (RCE) on the underlying operating system.

3. Infrastructure & Business Impact

Ivanti EPMM serves as a centralized Mobile Device Management (MDM) gateway. Successful exploitation grants attackers full control over registered mobile devices and access to sensitive corporate directories. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, posing an immediate threat of lateral movement and ransomware deployment within enterprise networks.

Official Vendor Advisories & References

NVD Original English Description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US

Source: support@hackerone.com · Vendor Advisory

https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-35082)

FAQ

Q1. How critical is CVE-2023-35082 and is it actively exploited in the wild?

CVE-2023-35082 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-35082?

Primary impacted vendors include ivanti across epmm, mobileiron_core. Scope summary: Ivanti EPMM versions 11.10, 11.9, 11.8, 11.7 and older, and MobileIron Core versions 11.2 and older

Q3. What temporary mitigations or workarounds exist for CVE-2023-35082 before patching?

[Mitigation] Immediately upgrade to the latest supported release and restrict external access to administrative API endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION