CVE-2023-35082 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 January 2024, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means for Ivanti EPMM and MobileIron Core
An authentication bypass in a mobile device management platform is especially dangerous because it can let an attacker reach administrative functions without proving who they are. For systems that manage devices, policies and remote access, that can turn a single weakness into broad control over enrolled endpoints and the identities or secrets they store.
Authentication bypass issues in perimeter and management products are often high impact because they sit close to trust boundaries. When attackers can impersonate a legitimate caller, they may not need malware on every endpoint, they only need one reachable weakness in the control plane.
How exposure is typically checked
The first question is whether the organisation runs the affected product at all, then whether any instance is reachable from untrusted networks. Asset inventory, internet exposure review and vendor advisory checks are the practical ways to confirm whether the issue matters in your environment.
For vulnerability triage, the authoritative sources are the vendor advisory for fix and mitigation details and the NIST National Vulnerability Database for the canonical CVE record. The CVE Program provides the official identifier and record structure, while the CISA KEV catalogue tells you whether exploitation has been publicly observed.
Why authentication bypass is dangerous in a management platform
Management systems like EPMM and MobileIron Core often sit on the path to device enrollment, policy enforcement and administrative access. If authentication is bypassed, the attacker may be able to enumerate data, alter configuration, impersonate users or pivot into connected services that trust the platform.
This kind of flaw is not just about logging in without a password. It can undermine trust in the management plane itself, which is why the compromise review should include admin activity, configuration changes, created accounts, policy drift and any unexpected access to stored credentials, tokens or certificates.
Comparable bypass-driven incidents in adjacent edge and management products show how quickly session or credential compromise can spread, including Ivanti Connect Secure exploitation 2024 and CitrixBleed 2 2025, where attackers abused trusted access paths rather than brute-forcing credentials.
Remediation, detection and compromise review
Priority should go to the vendor fix or documented mitigation, because bypass flaws in exposed management products are commonly exploited quickly after disclosure. If patching is delayed, reduce exposure by restricting network reachability, tightening administrative access paths and disabling unnecessary interfaces or integrations.
Detection should focus on signs that the platform was used as a launch point: unusual administrative logins, changes to device groups or policies, new accounts, unexpected API activity and signs of lateral movement from the appliance or server. After remediation, review whether attackers could have stolen sessions, credentials, API keys or certificates from the platform or its adjacent integrations.
Where exposure involves identity material, the response should include rotation of any credentials or tokens that may have been accessible through the compromised system. That matters because a control-plane compromise often leaves behind valid access paths even after the original vulnerability is fixed.
Risk and Threat Considerations
Because this is a real-world authentication bypass in a management product, the main risk is direct unauthorised access to a system that can control many other systems. Attackers value this class of weakness because it can provide quiet, high-trust access without needing to compromise every endpoint individually.
Failure mechanism: The attacker abuses a logic flaw in authentication handling, reaches privileged functions as an unauthenticated or wrongly trusted caller, and then uses that access to alter configuration, harvest data or pivot to downstream services.
Impact: The result can include administrative takeover, exposure of managed-device data, loss of trust in policy enforcement and the need to treat connected credentials or sessions as potentially compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Authentication bypass directly undermines organizational-user authentication controls. |
| IA-5 — Authenticator Management | Compromise review may require rotating authenticators, sessions and tokens exposed through the platform. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-compromise review depends on review of administrative and access logs for abnormal activity. | |
| Recommendation — Enforce strong organizational-user authentication for management interfaces and verify no bypass path remains. Rotate exposed authenticators and invalidate any sessions or tokens the appliance may have disclosed. Review audit records for anomalous administrative access and configuration changes around the exposure window. | ||
| CIS Controls v8 | CIS-5 — Account Management | Bypass flaws in admin systems often require account and privilege review after exploitation. |
| Recommendation — Review and remove unauthorized accounts, privileges and access paths created through the compromised platform. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited for authorized users, services, and devices. | This vulnerability is fundamentally about failed authentication and trust in issued access. |
| Recommendation — Audit credential issuance and revocation for any access paths the bypass could have abused. | ||
Practitioner Guidance
Why practitioners should care: Treat authentication bypasses in management planes as infrastructure-level incidents, not isolated application bugs. The control surface is usually broader than the product banner suggests, especially when the product mediates enrolment, policy delivery or remote administration.
What to watch for: Look for unexplained administrative actions, new users, unexpected configuration drift and access patterns that do not match normal management workflows. If the platform was internet-facing, assume the exposure window was exploitable as soon as the vulnerability became public.
Practitioner takeaway: The safest assumption is that a bypassed management system may have enabled both unauthorised access and secondary credential exposure, so response should cover the platform and any trust relationships it fed.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org