CVE-2023-35082 Ivanti CVE debrief

Who should care

Organizations running Ivanti Endpoint Manager Mobile (EPMM) or MobileIron Core, especially teams responsible for endpoint management, mobile device management, incident response, and vulnerability remediation. Security leaders should treat this as urgent because it is in CISA’s KEV catalog and associated with known ransomware campaign use.

Technical summary

The supplied source corpus identifies CVE-2023-35082 as an authentication bypass issue in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core. CISA’s KEV entry references Ivanti’s advisory describing remote unauthenticated API access in MobileIron Core 11.2 and older. The KEV record does not provide CVSS in the supplied data, but it does classify the issue as actively exploited and requires mitigation or discontinuation if mitigations are unavailable.

Defensive priority

Urgent. KEV listing plus known ransomware campaign use make this a top remediation item. Organizations should verify whether any affected Ivanti EPMM or MobileIron Core instances remain exposed and prioritize mitigation immediately.

Recommended defensive actions

• Inventory all Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core deployments.
• Review the vendor’s official guidance and apply the prescribed mitigations immediately.
• If mitigations are unavailable or cannot be validated quickly, discontinue use of the product as CISA recommends.
• Check for exposure to unauthenticated API access paths referenced by the vendor advisory.
• Search for signs of compromise and review authentication, API, and admin activity on affected systems.
• Prioritize incident response and containment if the product is internet-facing or otherwise broadly reachable.

Evidence notes

Evidence used is limited to the supplied CVE metadata, CISA KEV record, and official resource links. The corpus states: vendor/project Ivanti; product Endpoint Manager Mobile (EPMM) and MobileIron Core; vulnerability name Authentication Bypass Vulnerability; KEV date added 2024-01-18; due date 2024-02-08; known ransomware campaign use: Known; and required action: apply mitigations per vendor instructions or discontinue use if mitigations are unavailable. The supplied notes also reference an Ivanti forum advisory about remote unauthenticated API access in MobileIron Core 11.2 and older.

Official resources