CVE-2023-35078Ivanti EPMM (MobileIron Core) unauthenticated API access
What broke
Ivanti EPMM (formerly MobileIron Core), versions 11.8, 11.9, and 11.10, exposed authenticated API functionality to an unauthenticated caller. Attackers read user and device inventories and, chained with CVE-2023-35081, wrote to the appliance. CISA KEV. Disclosed 24 July 2023 after in-the-wild use.
Why it matters
EPMM decides which phones are trusted for Conditional Access and which users get mail. An unauthenticated API there is an identity bypass that your IdP never sees. The 2025 EPMM API authentication bypass, CVE-2025-4427, chained with CVE-2025-4428 for unauthenticated code execution, is the same product class failing again.
What to do
- Patch EPMM. If it was internet-facing in July 2023, assume data was read and review device-compliance decisions made afterward.
- Take EPMM admin and API off the internet.
- Pair device trust with phishing-resistant MFA. MDM compromise should not be enough to become the user.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2023-35078
- Ivanti, CVE-2023-35078 blog, 24 July 2023
- CISA KEV
Related identity CVEs
Related on Start with Identity
- CVEIvanti Endpoint Manager authentication bypass leaks stored credentials
An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 let an unauthenticated remote attacker read specific stored credential data. Patched Februar
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the