Start with Identity
Subscribe
Identity CVE · Other

CVE-2023-35078Ivanti EPMM (MobileIron Core) unauthenticated API access

criticalCISA KEVActively exploited
Product: Ivanti Endpoint Manager Mobile (MobileIron Core)Vendor: IvantiDisclosed: 2023-07-24Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

Ivanti EPMM (formerly MobileIron Core), versions 11.8, 11.9, and 11.10, exposed authenticated API functionality to an unauthenticated caller. Attackers read user and device inventories and, chained with CVE-2023-35081, wrote to the appliance. CISA KEV. Disclosed 24 July 2023 after in-the-wild use.

Why it matters

EPMM decides which phones are trusted for Conditional Access and which users get mail. An unauthenticated API there is an identity bypass that your IdP never sees. The 2025 addUser bug is the same product class failing again.

What to do

  • Patch EPMM. If it was internet-facing in July 2023, assume data was read and review device-compliance decisions made afterward.
  • Take EPMM admin and API off the internet.
  • Pair device trust with phishing-resistant MFA. MDM compromise should not be enough to become the user.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.