How do you patch or mitigate CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)?

CISA’s required action for CVE-2023-35082 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What actually changes when you treat CVE-2023-35082 as an exposure problem

The practical question is not just whether the product has a fix, but whether any deployment is still reachable by untrusted networks. For this issue, your first task is inventory and exposure control: identify every Ivanti Endpoint Manager Mobile and MobileIron Core instance, confirm whether it is internet-facing, and determine whether the vendor mitigation can be applied cleanly in the current environment.

When a vulnerable management plane is reachable, the safest assumption is that it should be treated as a high-value access path until the vendor action is complete. If you need a broader prioritisation lens for what to remediate first across the estate, use the CISA Known Exploited Vulnerabilities Catalog alongside your own exposure inventory, and verify the product record in the CVE Program before changing anything.

In practice, the mitigation path is simple but unforgiving: follow the vendor instructions exactly, and if the documented mitigation cannot be applied safely, remove internet exposure or discontinue the product. This is the right choice when a legacy management platform cannot be hardened quickly enough to reduce the reachable attack surface to an acceptable level.

How to reduce risk when patching or mitigation cannot happen immediately

If you cannot complete remediation in one change window, focus on shrinking exposure rather than waiting for a perfect fix. That means constraining inbound access, isolating the appliance or service path, and making sure no unnecessary administrative interfaces remain reachable from the internet or from broad internal networks.

For management products, “mitigation” often means compensating controls that buy time, not a substitute for remediation. If the vendor-provided safeguard depends on network placement or access restriction, document that dependency clearly so operations, networking and security teams apply the same boundary consistently.

Where you need a control baseline for handling exploited vulnerabilities at scale, the NIST Cybersecurity Framework 2.0 is useful for organising inventory, protection and response decisions, while the same framework can also help you justify a temporary business exception only when the exposure is tightly contained and time-bound.

What to check after the fix is in place

After mitigation or patching, validate more than version status. Confirm that the instance is no longer exposed in the way the advisory warned about, that administrative access is limited to intended operators, and that no alternate path still presents the same trust boundary to the internet.

Because authentication bypass issues can be used for early foothold or follow-on access, review logs for unusual administrative actions, new accounts, configuration changes, unexpected exports, or evidence of remote commands issued before remediation. If you find signs that the device or service was accessed before the fix, treat it as a possible compromise event rather than a routine patch completion.

If you need an authoritative source for the remediation record itself, confirm the affected record and ecosystem details in the NIST National Vulnerability Database, then keep your internal evidence tied to the exact assets you remediated.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE remediation depends on finding exposed instances and tracking patch status.
Recommendation — Prioritise and remediate exposed Ivanti instances through continuous vulnerability management.
NIST CSF 2.0	ID.AM-01 — Physical Devices and Systems Inventory	You must identify every EPMM and MobileIron Core instance before applying mitigation.
	PR.DS-01 — Data-at-rest is protected	If the platform handled sensitive management data, exposure reduction and containment are part of remediation.
Recommendation — Inventory all Ivanti deployments before you validate remediation status. Protect sensitive management data by containing or removing vulnerable exposures.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue calls for applying vendor mitigation or removing the product when no fix is viable.
	RA-5 — Vulnerability Monitoring and Scanning	Confirm exposure and track vulnerable instances across the estate before and after mitigation.
Recommendation — Apply vendor remediation promptly or disable the vulnerable product path. Scan for Ivanti instances and validate that remediation closed the exposure.

Practitioner Guidance

What to prioritise: Start with internet-facing EPMM and MobileIron Core instances, because reachable management surfaces create the highest urgency even before you know whether exploitation occurred. If the product cannot be safely mitigated in place, removal from service is a legitimate security outcome, not a failure to patch.

What to verify: Do not stop at “patched” as a status field. Verify that the vendor’s required action was actually applied, that the instance is no longer externally reachable in the vulnerable way, and that no stale firewall rule, reverse proxy rule or legacy admin path reopens the same exposure.

Decision rule: If you cannot confirm the mitigation works as intended, or if the appliance still needs broad network reach to function, treat that as an exception with a short expiry and a documented shutdown path. A management system that cannot be constrained should be retired rather than left exposed.

Practitioner takeaway: For this CVE, the security decision is about reachable attack surface first and software version second, so remediation is complete only when the vulnerable path is closed or the product is removed.