Actively exploited in the wild
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Ivanti — Endpoint Manager Mobile (EPMM) · Listed in the CISA KEV since 2023-07-25. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-35078
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile — higher than 100% of all known CVEs
Summary
CVE-2023-35078 describes an authentication bypass vulnerability in Ivanti EPMM that allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data and functions, potentially leading to serious security breaches.
Recommendation
It is recommended to immediately patch the vulnerability and review and strengthen the authentication mechanisms in the application.
Original NVD description (English source)
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.