How do you patch or mitigate CVE-2023-35081 (Ivanti Endpoint Manager Mobile (EPMM) Path Traversal)?

By NHI Mgmt Group Editorial Team Updated October 17, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2023-35081 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Endpoint Manager Mobile (EPMM) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

Finding every EPMM instance matters because the fix is only useful if you can prove where the product is deployed and whether it is reachable from the internet. Treat this as an asset and exposure problem first, then a patch problem. If the product is present, verify the vendor update or mitigation path on a live system rather than assuming a generic mobile-management workflow will close the issue.

When the vendor mitigation is available, apply it to every exposed deployment and confirm the affected service is no longer accepting unauthenticated traversal requests. If the environment cannot be remediated cleanly, remove internet exposure immediately and move the system out of service until the risk is reduced. For broader vulnerability triage and remediation discipline, use Vulnerability Management Guide as the operational reference point.

A path traversal issue is dangerous because it often becomes a stepping stone to sensitive files, configuration material, or further compromise if the application sits on a public-facing edge. In products that manage devices and users, the blast radius can expand quickly if the vulnerable service also exposes administrative interfaces or stored secrets. The practical decision is whether you can contain exposure before an attacker can reach the vulnerable path.

Do not assume that applying a single change everywhere is enough. Validate each instance, because internet-facing appliances and clustered deployments often drift in configuration, patch state, and network exposure. Use the vendor advisory for the exact remediation path and the CISA Known Exploited Vulnerabilities Catalog to confirm the urgency and required action for this CVE. For product identification and record lookup, check the NIST National Vulnerability Database and the CVE Program.

Risk and Threat Considerations

Path traversal on a public-facing mobile management platform can expose data beyond the intended application boundary, especially when the service is used to administer devices or store configuration material. If the product is internet exposed, the main risk is not only the vulnerable path itself but the downstream access it can unlock if an attacker reaches files, secrets, or administrative functions.

Failure mechanism: The attacker sends crafted path input to force the application to resolve resources outside the expected directory or request scope. On an exposed management service, that can enable unauthorized read access, reconnaissance, or a follow-on compromise path that survives basic perimeter controls.

Impact: Exposure can range from information disclosure to broader takeover risk if the traversal reaches sensitive configuration, tokens, or management data. If remediation is delayed, the safest containment is to remove public access or take the service offline until a documented mitigation is in place.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Path traversal remediation depends on finding every exposed instance and tracking fix state.
	CIS-12 — Network Infrastructure Management	Removing internet exposure is a key containment step when patching is not immediately possible.
Recommendation — Inventory EPMM, verify exposure, and drive remediation through continuous vulnerability management. Restrict external access paths to EPMM and keep only necessary management reachability.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE response requires identifying affected assets and validating remediation status.
	SI-2 — Flaw Remediation	The core action is applying the vendor mitigation or update and validating it on each deployment.
Recommendation — Scan for EPMM, confirm exposure, and track remediation until the vulnerable service is fixed or isolated. Apply the vendor fix or mitigation and verify it on every EPMM instance before restoring normal access.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a technical vulnerability that must be identified, assessed, and remediated or contained.
Recommendation — Record the EPMM issue, apply the vendor mitigation, and keep exposure removed until remediation is complete.

Practitioner Guidance

What to verify: Confirm every EPMM deployment, including forgotten test or secondary instances, and check whether any are still reachable from the internet. If an instance cannot be patched promptly, verify that exposure has actually been removed rather than merely reduced.

Decision rule: If the vendor mitigation can be applied cleanly, do that first and validate it from the outside. If it cannot be applied, treat continued internet exposure as the higher-risk condition and remove the service from use until it can be safely remediated.

Practitioner takeaway: For an exploited edge CVE, containment is part of the fix, because the operational question is whether the vulnerable product can still be reached while you are waiting for a cleaner repair path.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org