PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-35078 Ivanti CVE debrief

CVE-2023-35078 is an Ivanti Endpoint Manager Mobile (EPMM) authentication bypass issue associated with remote unauthenticated API access. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-07-25 and marked known ransomware campaign use as Known, which makes this an active-risk item rather than a purely theoretical flaw. The defensive priority is to follow vendor mitigation guidance immediately; if mitigations are not available, CISA’s stated fallback is to discontinue use of the product.

Vendor
Ivanti
Product
Endpoint Manager Mobile (EPMM)
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2023-07-25
Original CVE updated
2023-07-25
Advisory published
2023-07-25
Advisory updated
2023-07-25

Who should care

Security and platform teams responsible for Ivanti Endpoint Manager Mobile (EPMM), especially administrators of exposed management interfaces, incident responders, and vulnerability management teams tracking CISA KEV items.

Technical summary

The supplied official records describe CVE-2023-35078 as an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM), with the associated exposure described as remote unauthenticated API access. The CISA KEV entry indicates the vulnerability is known to be exploited and records known ransomware campaign use as Known. The source corpus does not provide a CVSS score, so prioritization should be based on exploitation status and vendor guidance rather than severity scoring alone.

Defensive priority

Critical. CISA KEV inclusion and known exploitation make this an immediate mitigation or removal priority.

Recommended defensive actions

  • Apply mitigations per vendor instructions referenced by CISA and Ivanti.
  • If mitigations are unavailable, discontinue use of the product as CISA directs.
  • Treat EPMM instances as urgent exposure-management candidates and verify whether any affected deployments remain in service.
  • Use the official CVE, NVD, and CISA KEV references to track status and response requirements.

Evidence notes

All claims are based on the supplied CISA KEV source item and official reference links. The KEV metadata states the vulnerability name, dateAdded 2023-07-25, dueDate 2023-08-15, knownRansomwareCampaignUse as Known, and requiredAction to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable. The provided CVE and NVD links are official corroborating references, but the corpus does not include a CVSS score.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-35078 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-35078

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-35078 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-35078

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.