CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass

Exploited in the wild Critical 10.0 Published 15 Aug 2023 Updated 21 Oct 2025

Unauthorized users can bypass authentication to access restricted functionality or resources in Ivanti EPMM.

Exploited in the wild: Since 18 Jan 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35082?

CVE-2023-35082 is a critical authentication bypass vulnerability in Ivanti EPMM, published on 15 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Weakness: CWE-287

Which versions are affected by CVE-2023-35082?

It affects 1 product.

Products include Ivanti Endpoint Manager Mobile.

How do I fix CVE-2023-35082?

No fix has been published for CVE-2023-35082 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 8 Feb 2024.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-35082 being exploited?

Yes. Attackers have exploited CVE-2023-35082 in the wild since at least 18 Jan 2024, including in ransomware campaigns.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-w2p6-rj4r-fqxv.