Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability (CVE-2023-35078)
Severity: critical · Patch status: unknown · Since 2023-07-25 · CVE-2023-35078
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. CISA added CVE-2023-35078 to its Known Exploited Vulnerabilities catalog on Jul 25, 2023, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Aug 15, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
