← CVE Radar
CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
9.8 CRITICALEPSS 99.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | CRITICAL | 3.0hackerone (CNA) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Aug 15, 2023
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-35078
- Status
- Analyzed
- Assigner (CNA)
- hackerone
- Published
- Jul 25, 2023
- Last modified
- 2026-08-05 05:16 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
IvantiEndpoint Manager Mobile0 version ranges
No version detail published.
References
- forums.ivanti.com https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
- forums.ivanti.com https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
- cisa.gov https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
- ivanti.com https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078