# CVE-2023-35082

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

- Page: https://www.vulneraibility.com/cve/CVE-2023-35082
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-01-18; CISA due date 2024-02-08; known ransomware use
- EPSS: 100.00% (percentile 100.0)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept · 1 Nuclei template (first 2023-08-04)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-03)
- Published: 2023-08-15

## Affected versions

- Ivanti EPMM: affected <= 11.10

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.