10

CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

CVSS: 10.0v3.0CriticalKEVRansomwareAnalyzed
Published 15-08-2023Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2023-35082 is a critical (CVSS 10.0) Improper Authentication vulnerability in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. It is known to be exploited: CISA lists it, first on 18-01-2024. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.

Overall risk
100/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.0 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Timeline

  1. 15-08-2023
    PublishedVulnerability first disclosed.
  2. 18-01-2024
    Added to CISA KEVIvanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
  3. 08-02-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 100.00% on 20-09-2026

20-09-202620-10-2026
EPSS score
100.00%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
18-01-2024
Federal due date
08-02-2024
Ransomware

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. forums.ivanti.com/s/… nvd.nist.gov/vuln/detail/CVE-2023-35082

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ivanti2 products

1 vendor · 2 products

References

2 links