Critical severity9.8CISA KEVNVD Advisory· Published Aug 15, 2023· Updated Jun 17, 2026

CVE-2023-35082

Description

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Affected products

Ivanti/Endpoint Manager Mobile
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
Range: <11.11.0
Ivanti/MobileIron Corellm-fuzzy
Range: <=11.2
Ivanti/EPMMllm-fuzzy2 versions
<=11.10+ 1 more
- (no CPE)range: <=11.10
- (no CPE)range: 11.10

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-oldernvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors in New Attacks
Cyber Security News · Jun 19, 2026

cvss	0.637
epss	0.080
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.060