CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-35082

CVSS 9.8v3.1pub. 2023-08-15upd. 2025-10-31

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ivanti Endpoint Manager Mobile

    APP
    Ivanti
    < 11.11.0

CISA KEV — detailsi

Vendori
Ivanti ↗
Producti
Endpoint Manager Mobile (EPMM) and MobileIron Core
Added to KEVi
January 18, 2024
Remediation deadline (US Federal)i
February 8, 2024(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 8 lutego 2024
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-1281CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Krytyczny code injection w Ivanti Endpoint Manager Mobile (RCE bez uwierzytelnienia)

CVE-2026-1340CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Code injection w Ivanti EPMM umożliwiający nieuwierzytelniony RCE

CVE-2023-35078CRITICAL9.8⚠ KEVten sam produkt

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functiona...

CVE-2024-36130CRITICAL9.8PL ✓ten sam produkt

Ivanti EPMM: obejście autoryzacji umożliwiające zdalne wykonanie poleceń

CVE-2023-39335CRITICAL9.8ten sam produkt

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unaut...