⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 10.0 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2023-35082: Ivanti EPMM / MobileIron Core Auth Bypass

*By Sai Kiran Pandrala*

⚡ At a glance
SeverityCVSS 10.0, Critical
Actively exploited?Yes, listed in CISA KEV (added 2024-01-18)
AffectedIvanti Endpoint Manager Mobile (EPMM) 11.10 and earlier, plus legacy MobileIron Core 11.2 and earlier
Fixed inIvanti EPMM 11.10.0.2 and later (see vendor knowledge article); upgrade off end-of-life MobileIron Core
Type (CWE)Authentication Bypass (related to CWE-287)

⚠️ Patch or take offline. This CVE was chained with CVE-2023-35078 in real attacks for full unauthenticated RCE. CISA added it to KEV on January 18, 2024. Public exploit code exists.

What is CVE-2023-35082?

Ivanti EPMM (the rebranded name for what used to be called MobileIron Core) exposes a management API. The authentication check on certain API paths is missing or improperly applied in EPMM 11.10 and earlier. An unauthenticated remote attacker can call those paths and access restricted functionality, including reading and modifying device records.

By itself the bug is "just" unauthenticated information disclosure plus partial admin functionality. But CVE-2023-35082 was disclosed alongside CVE-2023-35078, and the combination chained into full remote code execution on the EPMM appliance, which is how the active-exploitation reports started rolling in. CISA's KEV listing reflects the combined risk.

EPMM manages enterprise mobile devices (BYOD policies, app pushes, MDM certificates, VPN configs). A compromised EPMM gives an attacker policy-level control over every managed iPhone, Android device, and corporate laptop in the fleet.

Am I affected?

You are affected if either is true:

To check EPMM version:

  1. Log into the EPMM Admin Portal.
  2. Go to Settings → System Information. The build number is at the top of the page.
  3. Or SSH into the appliance and run:

   show version

If the displayed version is 11.10 or below and the patched build (per Ivanti's knowledge article) is not installed, you are affected.

If you are still running MobileIron Core (any version), the urgency is higher. MobileIron Core has been end-of-life since November 2022 — Ivanti is not issuing fixes for it. The remediation is to migrate to EPMM (the supported product) on a patched build.

How to fix CVE-2023-35082

For Ivanti EPMM

  1. Open the Ivanti knowledge article linked in the references section. Ivanti publishes the exact patched build per supported train. The minimum fixed version is EPMM 11.10.0.2, but the recommended target is the latest GA release on the supported train.
  1. Download the patch bundle from the Ivanti support portal (your maintenance contract entitles you to access).
  1. Back up the appliance config. From the EPMM CLI:

   system backup

Verify the backup file is present in the configured backup repository before proceeding.

  1. Apply the patch from the Admin Portal under Settings → System Maintenance → Software Updates. Upload the patch package, validate the signature, install.
  1. Reboot the appliance when prompted. For HA pairs (active/standby), patch the standby first, fail over, then patch the formerly-active.
  1. Re-enroll a test device after the upgrade to confirm device-management flows still work end-to-end.

For mobileiron core (end-of-life)

The only supported remediation path is to migrate to Ivanti EPMM. There is no security patch for MobileIron Core 11.2 or earlier. Ivanti's published guidance:

  1. Stand up a new EPMM appliance at the latest supported build.
  2. Use Ivanti's MobileIron Core → EPMM migration tooling to move device records.
  3. Decommission the old MobileIron Core appliance immediately after migration.

If migration cannot happen in your patch window, take the MobileIron Core appliance off the public network at minimum, it should never have been internet-exposed in the first place.

If you can't patch immediately

Ivanti's advisory does not provide a feature-toggle workaround. The vulnerable API paths are part of the core EPMM service. Compensating controls:

How to verify the fix worked

  1. From the EPMM CLI:

   show version

Output should show the patched build (11.10.0.2 or higher, on a supported train).

  1. From the Admin Portal, Settings → System Information displays the same build identifier.
  1. Test the previously-vulnerable API paths with an unauthenticated client:

   curl -i -k https://<your-epmm>/api/v2/authorized/users

The expected post-patch response is HTTP 401 Unauthorized, not 200 with data.

  1. Run an authenticated vulnerability scan. The CVE-2023-35082 finding should clear.

Frequently asked questions

Other vulnerabilities in the same area that are worth patching alongside this one:

Is CVE-2023-35082 being exploited?

Yes. CISA's KEV listing on January 18, 2024 documents confirmed in-the-wild exploitation, and the vulnerability was chained with CVE-2023-35078 in observed attacks for full unauthenticated RCE.

What is the relationship between CVE-2023-35082 and CVE-2023-35078?

They are two separate Ivanti EPMM vulnerabilities disclosed in the same window. CVE-2023-35078 is the higher-impact RCE; CVE-2023-35082 is the auth bypass. In real attacks they were chained together. Patch covers both when you upgrade to the fixed EPMM build.

Is MobileIron Sentry affected?

MobileIron Sentry is a separate product (the gateway component) and has its own CVEs. Check the specific Sentry advisory separately if you run it. The Ivanti EPMM patch fixes only EPMM.

References

*This guide was assembled from the official Ivanti knowledge article, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against Ivanti's advisory before applying changes in production.*