Is CVE-2023-35078 (Ivanti Endpoint Manager Mobile Authentication Bypass) being exploited in the wild?

What “exploited in the wild” means for CVE-2023-35078

For a CISA KEV-listed CVE, “exploited in the wild” means the vulnerability is not just theoretical or proof-of-concept material, it has credible evidence of real-world abuse. In this case, the practical question is whether the Ivanti EPMM authentication bypass has moved from disclosure into active attacker tradecraft, which changes how urgently teams should validate exposure and review for compromise.

Because the flaw is an authentication bypass on API paths, the first operational concern is whether your EPMM instance is reachable and whether any exposed API surface could have been accessed without credentials. That makes it a service availability and access-control problem at the same time, not just a patching issue.

Authoritative confirmation should come from the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog, with the catalog being the clearest signal that exploitation has been observed and prioritised for remediation. For broader vulnerability triage, use the CVE Program record to align the identifier, and the NIST National Vulnerability Database for baseline record details and references.

How to confirm exposure and limit the blast radius

Start by identifying every internet-facing and partner-reachable Ivanti Endpoint Manager Mobile deployment, including legacy MobileIron Core branding in asset inventories. If you cannot prove the platform is absent, treat it as present until you have a complete inventory, because exposed management or API services are the usual failure point for this class of issue.

Then verify whether the instance was reachable from untrusted networks during the exposure window and whether logs show requests to the affected API paths or unusual administrative activity. If the system was exposed externally, assume the bypass may have been attempted even if you do not yet see obvious impact.

Where possible, isolate the service, restrict access to trusted management networks, and preserve relevant logs before making disruptive changes. If patching is delayed, the priority is to reduce reachability and preserve evidence rather than leaving the service broadly exposed while you investigate.

For practitioners who want a structured approach to exploitability triage, the FIRST EPSS model can help rank urgency, but KEV status should still drive immediate attention when active exploitation is confirmed.

Ivanti-specific exploitation history also matters because nearby products and related flaws have repeatedly been used to gain footholds, harvest credentials, and pivot deeper into environments. The broader pattern is that perimeter or mobile-management compromise often becomes an internal access problem very quickly, so asset scope and segmentation are part of the response, not just supporting tasks.

What to do while waiting on patching or validation

If remediation cannot happen immediately, focus on containment measures that reduce the attacker’s ability to reuse the bypass for post-exploitation access. That usually means tightening network exposure, disabling unnecessary administrative access paths, and checking whether the device or service can be temporarily removed from production traffic without breaking essential operations.

Review whether the EPMM instance has stored credentials, API tokens, certificates, or integration secrets that could have been reachable through the compromised service. If there is any chance those values were exposed, rotate them in an ordered way so that dependent systems do not fail unexpectedly.

Also examine downstream identity and management events, including newly created accounts, configuration changes, policy edits, or unusual enrolment activity. In practice, attackers who reach mobile management platforms often use them as a control plane, so the evidence to preserve is not limited to the vulnerable host itself.

For a broader handling model, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful for emergency mitigation, compromise assessment, and post-patch hunting, while the Vulnerability Management Guide is useful for scoping, prioritisation, exceptions, and verification.

Risk and Threat Considerations

Authentication bypass in a mobile management platform is high-risk because it can convert a single exposed service into unauthorized administrative or API access. Once an attacker can reach management functions without valid authentication, they may be able to enumerate devices, change policies, or use the platform as a pivot point into other managed services.

Failure mechanism: The control failure is at the trust boundary, where the service accepts requests that should have been blocked before any privileged API action was possible. That often leads to silent abuse first, then configuration drift, policy tampering, or credential exposure if the platform stores sensitive operational material.

Impact: The likely impact is broad because mobile management tools sit close to enterprise identity, device posture, and administrative workflows. A successful bypass can create unauthorized access, accelerate lateral movement, and force rotation of secrets or service integrations that the platform could touch.

Practitioner Guidance

What to verify: Confirm whether the EPMM instance was externally reachable, whether the vulnerable API paths were requested, and whether any privileged changes or unusual enrollments occurred during the exposure period. If logs are incomplete, treat that as an evidence gap and increase the scope of manual review.

Decision rule: If the system was internet-facing before remediation, prioritise containment and compromise assessment before assuming the absence of symptoms means the environment is clean. If the platform held integration secrets or administrative tokens, rotate them even when you have not yet proven direct abuse.

What practitioners underestimate: The real blast radius is often larger than the vulnerable appliance itself because management systems tend to concentrate access, trust, and automation. The right question is not only “was it exploited?”, but “what could it have authenticated to, controlled, or disclosed if it was.”

Practitioner takeaway: For KEV-listed authentication bypasses, exposure confirmation is only the first step; the decisive work is proving whether the platform became a trusted access path and then narrowing that path before an attacker uses it.

Related resources from NHI Mgmt Group

• CVE-2023-35078 (Ivanti Endpoint Manager Mobile Authentication Bypass)
• Is CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass) being exploited in the wild?
• How do you patch or mitigate CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)?
• CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)