Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-35082 Details

Description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:10 CRITICALVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082	CISA-ADP	US Government Resource
https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US	CVE	Vendor Advisory
https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US	[email protected]	Vendor Advisory

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability	Jan 18, 2024	Feb 8, 2024	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	[email protected]

Affected Products

Product	Versions
ivanti endpoint manager mobile	< 11.11.0
CPE cpe:2.3:a:ivanti:endpoint_manager_mobile:::::::: Remediation No remediation found in references.

Change History

11 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Oct 31, 2025	Modified Analysis	[email protected]
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Dec 26, 2024	Modified Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 19, 2024	CVE CISA KEV Update	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Aug 22, 2023	Initial Analysis	[email protected]