---
id: "CVE-2023-35082"
kind: "vulnerability"
aliases: ["CVE-2023-35082"]
title: "ivanti endpoint manager mobile: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ivanti endpoint manager mobile", "fixed": ["11.11.0"], "affected": "< 11.11.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["epmm", "exploited", "ivanti", "mobileiron", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2023-08-15T16:15:11+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-35082", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35082", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# ivanti endpoint manager mobile: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access…

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core have an authentication bypass that lets unauthenticated users reach restricted functions. CISA lists it as actively exploited, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core affected ? fixed ?
- vendor:ivanti endpoint manager mobile affected < 11.11.0 fixed 11.11.0

## Fix

Apply the mitigation or patch from Ivanti per vendor instructions, or discontinue use of the product if no mitigation is available.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-35082
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-35082

## From the sources

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_