CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) Path Traversal

Q: Is CVE-2023-35081 being exploited?

Yes. Attackers have exploited CVE-2023-35081 in the wild since at least 31 Jul 2023.

Q: How do I fix CVE-2023-35081?

No fix has been published for CVE-2023-35081 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Aug 2023.

Exploited in the wild High 7.2 Published 3 Aug 2023 Updated 14 Jan 2026

An authenticated administrator can exploit a path traversal flaw in Ivanti EPMM to write arbitrary files to the appliance.

Exploited in the wild: Since 31 Jul 2023
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35081?

CVE-2023-35081 is a high-severity path traversal vulnerability in Ivanti EPMM, published on 3 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.

Weakness: CWE-22

Which versions are affected by CVE-2023-35081?

It affects 1 product.

Products include Ivanti Endpoint Manager Mobile.

How do I fix CVE-2023-35081?

No fix has been published for CVE-2023-35081 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Aug 2023.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-35081 being exploited?

Yes. Attackers have exploited CVE-2023-35081 in the wild since at least 31 Jul 2023.

Sources

Also known as GHSA-8cjr-8gr7-ccg3.