What Is CVE-2023-35081 (Ivanti Endpoint Manager Mobile (EPMM) Path Traversal)?

By NHI Mgmt Group Updated October 17, 2026 Domain: Cyber Security

CVE-2023-35081 is a path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM). CISA added it to the Known Exploited Vulnerabilities catalogue on 31 July 2023, which means attackers have used it in real attacks. Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server.

What this vulnerability means in Ivanti Endpoint Manager Mobile

Path traversal in a mobile device management product matters because the management plane often sits at the centre of policy enforcement, device enrolment, configuration, and administrative trust. When an authenticated administrator can write malicious files on the server, the issue moves beyond ordinary file access and into server-side compromise risk.

In practice, that means the vulnerability is not just about reading or writing an unexpected path, it can become a foothold for altering how the management server behaves. Attackers who obtain the required administrative access can use the weakness to place content where the application was never meant to accept it, which is why KEV-listed path traversal issues in management software are treated as high priority.

How path traversal becomes dangerous

Path traversal is dangerous when application logic lets a request escape intended directories and reach files the software should protect. In an EPMM server, malicious file writes can affect application files, configuration, or other server-side artefacts, depending on how the product handles file paths and privileges.

That danger is amplified in software that centralises control over many mobile endpoints. A compromise of the management server can create a much broader blast radius than a single-device issue, because the server may influence policies, enrolment states, and security settings across the fleet.

For a wider view of how file-write and credential-exposure flaws in product ecosystems are exploited, Ivanti Connect Secure exploitation 2024 shows how edge-product compromise can quickly lead to credential theft and downstream lateral movement.

How organisations check exposure and reduce blast radius

Exposure review starts with knowing whether Ivanti Endpoint Manager Mobile is deployed, where it is reachable, and who can administer it. Organisations should confirm whether the server is internet-facing, whether administrative access is tightly limited, and whether any vendor guidance or emergency advisories apply to their installed build.

Because this is a known exploited vulnerability, asset inventory and prioritisation matter more than routine patch queues. The safest approach is to verify the exact product instance against the vendor advisory and the CISA KEV catalogue, then treat any reachable or externally managed installation as urgent until remediated.

For vulnerability triage and remediation workflow discipline, the Vulnerability Management Guide is the most direct operational companion for asset scoping, KEV prioritisation, and verification.

Detection, recovery, and identity impact after exploitation

Detection should focus on signs that a management server has accepted unexpected writes, altered files, or unusual administrative actions. Post-patch review matters because a fix does not prove the server was clean before remediation; compromise could have been used to plant web content, modify configuration, or create persistence.

If exploitation is suspected, organisations should also review privileged accounts, sessions, API credentials, and service access tied to the management platform. When an admin-level flaw is abused, the identity impact can extend beyond the server itself because those credentials may have been used to reach other systems or to change trust relationships.

For a broader incident lens on exploited appliance flaws and credential consequences, The State of NHI & AI Agent Breach Report 2026 is useful background on how compromised access often turns into stolen secrets and lateral movement.

Risk and Threat Considerations

Known exploited path traversal flaws in management software are especially risky because they combine privileged access, server-side file manipulation, and broad operational reach. If the management plane is exposed to the internet or lightly monitored, attackers can turn a single weakness into a durable foothold or a route to fleet-wide disruption.

Failure mechanism: An authenticated administrator abuses path handling to write malicious files outside the intended directory, then uses the altered server state for persistence, code execution, or follow-on access.

Impact: The management server may be modified, persistence may survive normal use, and downstream trust across managed devices and administrative workflows can be compromised.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This KEV-listed flaw requires exposure tracking and rapid prioritization.
Recommendation — Prioritize the Ivanti EPMM flaw in your vulnerability workflow and verify remediation status quickly.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This server-side vulnerability requires timely correction and validation after patching.
Recommendation — Remediate the flaw promptly and validate that affected servers are no longer exposed.
MITRE ATT&CK	T1006 — Direct Volume Access	Path traversal is a file-system abuse mechanism that can enable unauthorized file placement.
Recommendation — Map suspicious file-write activity to filesystem abuse and hunt for unauthorized server-side changes.
OWASP ASVS	V4 — API and Web Service	The flaw involves server-side request handling and file path validation in a web-exposed service.
Recommendation — Validate server-side path handling and reject requests that escape intended file boundaries.

Practitioner Guidance

Why practitioners should care: Treat this class of flaw as a management-plane incident, not a routine application bug. The highest-value response is to reduce exposure quickly, verify whether the server was reachable by untrusted parties, and confirm whether privileged accounts or sessions were exposed during the window of exploitation.

What to watch for: Unexpected file changes, unusual administrative actions, unexplained configuration drift, and suspicious access around the EPMM server deserve immediate review. If the server has been exploited, rebuild or validate the host rather than assuming patching alone removed attacker-controlled artefacts.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org

CVE-2023-35081 (Ivanti Endpoint Manager Mobile (EPMM) Path Traversal)