Exploited Vulnerabilities DailyCVE-2023-35078: Ivanti Endpoint Manager Mobile (EPMM)
EPSS99.9%No. 29 of 1739 in KEV
CVE year2023listed the same year
Same vendor in KEV35
Same product7
| Field | Value |
|---|---|
| Vendor | Ivanti |
| Product | Endpoint Manager Mobile (EPMM) |
| Name | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability |
| Added to KEV | 2023-07-25 |
| US federal due date | 2023-08-15 |
| Ransomware use | Known |
| CWE | CWE-287 |
CISA description
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
Other entries for this product
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-05-07 | 2.5% | Unknown |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-04-08 | 98.6% | Unknown |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) | 2026-01-29 | 98.6% | Unknown |
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | 86.5% | Unknown |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | 99.9% | Unknown |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) | 2023-07-31 | 63.5% | Unknown |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Ivanti Endpoint Manager Mobile (EPMM) vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2023-07-25.