CVE-2023-35082

What it actually does

CVE-2023-35082 is a network-exploitable authentication bypass in Ivanti Endpoint Manager Mobile / MobileIron Core 11.10 and older. An unauthenticated remote attacker can reach restricted application functionality or resources without valid credentials, potentially exposing sensitive device, user, and administrative data and enabling unauthorized changes through privileged management interfaces. The CVSS 9.8 vector indicates exploitation requires no credentials, no user interaction, and can compromise confidentiality, integrity, and availability. The provided affected-product metadata also lists Debian 11 Chromium with a fixed package version, which does not align with the Ivanti EPMM vulnerability description; teams should validate asset-to-CVE mapping before relying on package-only remediation status.

Why it matters to the business

This is a high-urgency, actively exploited vulnerability in a mobile device management platform, a system that often has broad visibility into users, devices, certificates, configuration profiles, and enterprise access controls. Successful exploitation can lead to exposure of sensitive user and device information, unauthorized administrative actions, disruption of mobile device management operations, and follow-on compromise of managed endpoints or enterprise applications. The vulnerability is in CISA KEV, has an EPSS score near 1.0, is reported as used in ransomware-related activity, and had a CISA remediation deadline of 2024-02-08, so any remaining exposure should be treated as an incident-level priority rather than routine patching.

How an attack unfolds

An attacker scans the internet or internal address space for exposed Ivanti EPMM / MobileIron Core services, usually over HTTPS. After identifying a vulnerable 11.10-or-older instance, the attacker sends crafted requests to restricted application or API functionality that should require authentication but is incorrectly reachable. If the bypass succeeds, the attacker can enumerate sensitive information, access management functions, and potentially make unauthorized configuration or account-related changes depending on the exposed function. Because EPMM commonly manages mobile devices and enterprise access, attackers may use the initial bypass to collect user, device, token, certificate, or policy information, then pivot to additional vulnerabilities, credential theft, persistence, or ransomware deployment. Public reporting and KEV status indicate exploitation has occurred in the wild, so exposed legacy systems should be investigated for prior compromise even if they are later patched.

How to fix it

Upgrade Ivanti EPMM / MobileIron Core to a vendor-supported fixed release that remediates CVE-2023-35082; do not leave 11.10 or older versions exposed. If the product is end-of-life or cannot be upgraded immediately, remove external exposure, restrict access to trusted administrative networks or VPN, enforce network-layer allowlisting, and monitor aggressively until replacement or upgrade is complete. Review Ivanti advisories for the exact target release appropriate to the deployed branch and apply all related EPMM fixes, because this vulnerability has been exploited alongside other Ivanti EPMM flaws. The supplied package data lists Debian 11 Chromium fixed in 120.0.6099.71-1~deb11u1; if Chromium on Debian 11 is also in scope for a separate finding, update to that version or later, but do not treat that package update as remediation for Ivanti EPMM unless asset mapping has been independently confirmed.

How to confirm the fix worked

Confirm the deployed Ivanti EPMM / MobileIron Core version is newer than the affected 11.10-and-older range and is on a vendor-supported fixed release. Verify that no vulnerable EPMM administrative or API interfaces are reachable from the internet except through approved access controls. Use authenticated vulnerability scanning, vendor health checks, and configuration review to confirm the patch level. Perform a controlled negative test that unauthenticated requests to restricted EPMM functions return an authentication failure rather than data or application functionality. Validate that reverse proxies, WAFs, and load balancers do not route unauthenticated requests to legacy EPMM nodes. Where the Debian Chromium package finding is separately relevant, verify with package inventory that chromium is at 120.0.6099.71-1~deb11u1 or later on Debian 11 systems.

Typical attack path

1. Identify internet-facing or internally reachable Ivanti EPMM / MobileIron Core services.
2. Fingerprint the service version or infer vulnerability based on exposed behavior and application responses.
3. Send unauthenticated requests to restricted EPMM application or API functionality.
4. Use the authentication bypass to access sensitive resources or administrative functions without valid credentials.
5. Enumerate users, devices, policies, certificates, tokens, configuration data, or other management-plane information.
6. Perform unauthorized changes or chain the access with other vulnerabilities to gain persistence, write files, execute commands, or broaden access.
7. Use collected information for lateral movement, endpoint compromise, data theft, operational disruption, or ransomware activity.

How to detect it

Investigate as potentially already exploited. Collect and review Ivanti EPMM / MobileIron Core web server logs, application logs, API access logs, administrator audit logs, device action history, authentication/session logs, reverse proxy logs, WAF logs, VPN logs, and EDR telemetry from the EPMM host. Look for unauthenticated requests to restricted API or management paths, especially HTTP 200/201/204 responses where no valid session cookie, bearer token, or authenticated user is present. Correlate unusual API enumeration, large response sizes, repeated requests to user/device/certificate/policy endpoints, and access from unfamiliar internet IPs. Review for new or modified administrator accounts, unexpected device wipe/lock/profile actions, certificate or token export activity, configuration profile changes, new files written by the web application user, suspicious child processes spawned by the application server, and outbound connections from the EPMM server to untrusted destinations. Because this vulnerability has been exploited in the wild and associated with ransomware activity, extend the lookback to the publication date or earlier if logs allow, and correlate with exploitation of related Ivanti EPMM vulnerabilities.

• /mifs/aad/api/v2/
• /mifs/asfV3/api/v2/
• /mifs/rs/api/v2/
• /mifs/
• MobileIron Core
• Ivanti EPMM
• GET /mifs/
• POST /mifs/
• HTTP 200 response to /mifs/ request without authenticated session cookie
• mi.war
• mifs.war
• tomcat
• catalina.out

What your security team should do

• Treat any exposed Ivanti EPMM / MobileIron Core 11.10-or-older instance as a potential compromise due to active exploitation, KEV listing, ransomware association, and near-certain EPSS likelihood.
• Immediately upgrade to a supported fixed Ivanti EPMM release or remove the service from external reachability until patched.
• Run an incident-response review for historical exploitation, including web access logs, application logs, administrator audit logs, device-management actions, account changes, and unusual API activity.
• Hunt for unauthenticated access to EPMM API or restricted application paths, especially requests returning HTTP 200/2xx responses without a valid authenticated session.
• Rotate or revoke credentials, API tokens, certificates, and enrollment secrets that may have been exposed through the management platform.
• Review managed-device policies, profiles, compliance actions, and administrator accounts for unauthorized changes.
• Place EPMM administrative and API interfaces behind VPN, identity-aware proxy, or strict network allowlisting, even after patching.
• If asset inventory reports this as Debian Chromium rather than Ivanti EPMM, correct the vulnerability-to-asset mapping and separately ensure Debian 11 Chromium is updated to 120.0.6099.71-1~deb11u1 or later.