CVE-2023-35078 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM). CISA added it to the Known Exploited Vulnerabilities catalogue on 25 July 2023, which means attackers have used it in real attacks. Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths.
What Makes This Vulnerability Dangerous in EPMM
An authentication bypass in an internet-facing mobile management product is dangerous because it can remove the normal gate between an attacker and the administrative or API functions that control devices, policies, and data. In practice, that means the vulnerability is not just a login flaw, it can become an entry point to the management plane itself.
Because the affected surface includes API paths, the risk is often broader than a single web page or user portal. The most useful way to think about it is as a trust-boundary failure: if unauthenticated requests can reach privileged functions, the product can be abused before any identity check or session control has a chance to work.
How Exposure Is Identified
Organisations should first confirm whether they run Ivanti Endpoint Manager Mobile, including instances still known by the older MobileIron Core branding. The key exposure questions are simple: is the product deployed, is it reachable from the internet, and does the current environment match the version and patch status described in the vendor advisory and the CVE Program record?
Asset inventory matters here because these appliances are easy to overlook when teams focus only on endpoint agents and forget the management tier. External exposure matters too, since a vulnerability that can be triggered remotely becomes much more urgent when the interface is reachable without network segmentation or compensating controls.
What Failure Looks Like After Bypass
Once authentication is bypassed, the attacker’s next move is usually to probe the API surface for functions that reveal configuration, device data, administrative state, or additional access paths. The exact consequence depends on how the environment is configured, but the core problem is the same: the attacker can act as if they were trusted long before legitimate authentication would normally occur.
That is why bypass flaws in management platforms often become staging points rather than end goals. They can enable reconnaissance, tampering, device policy abuse, credential harvesting, or follow-on movement into adjacent systems that rely on the management platform’s trust.
Why Remediation and Review Matter
The primary response is to follow the vendor’s remediation guidance and the CISA KEV entry for patch and version details, rather than relying on third-party summaries. If immediate patching is not possible, organisations should reduce exposure with tight network access, temporary isolation of the management interface, and monitoring of all reachable API activity until the issue is resolved.
After patching, teams should review logs and configuration changes for signs that the bypass was already used. If there is any indication of abuse, rotate administrative credentials, API keys, and any other secrets or sessions that could have been accessed through the compromised management plane. NIST Cybersecurity Framework 2.0 also provides a useful structure for organizing identify, protect, detect, respond, and recover work around this kind of exposure.
Risk and Threat Considerations
This kind of flaw is attractive to attackers because it collapses a high-value trust boundary. In a product that manages devices and APIs, unauthenticated access can become a fast path to privileged actions, data exposure, and persistent administrative control.
Failure mechanism: The vulnerability removes the authentication check from specific request paths, so malicious requests can reach functions that were designed to be protected by identity and session controls.
Impact: Attackers can use the exposed management surface for reconnaissance, unauthorized changes, theft of sensitive data, or as a foothold for broader compromise of the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | This CVE requires knowing where EPMM is deployed and exposed. |
| PR.AA-01 — Identities and Credentials Issued, Managed, Verified, Revoked, and Audited | Authentication bypass turns identity and credential handling into the key control concern. | |
| DE.CM-01 — Networks and Services Monitored to Find Potentially Adverse Events | Detection depends on monitoring API and administrative activity after exploitation. | |
| Recommendation — Inventory every EPMM instance and verify its exposure and patch status. Revoke and rotate credentials or sessions that may have been exposed. Monitor management-plane logs for unauthenticated access and unusual API activity. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The vulnerability bypasses the authentication expected for administrative use. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analysing logs for misuse of the bypass. | |
| Recommendation — Enforce strong administrator authentication and verify all privileged access paths. Review audit records for suspicious management-plane activity after remediation. | ||
Practitioner Guidance
Why practitioners should care: Treat management-plane authentication bypasses as high-priority exposure even when no public exploit details are available for your exact deployment. These flaws often affect the systems that sit closest to device control and identity-adjacent operations, so a short delay in validation can create an outsized blast radius.
What to watch for: Look for unexpected API access, abnormal administrative actions, configuration drift, or log entries that indicate requests succeeded without the authentication patterns you normally expect. If the platform is internet-exposed, verify compensating controls as part of the same response window, not as a later hardening task.
Related resources from NHI Mgmt Group
- CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)
- CVE-2025-4427 (Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass)
- CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass)
- CVE-2026-1340 (Ivanti Endpoint Manager Mobile (EPMM) Code Injection)