Loading story…
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, CVE-2023-35078 and CVE-2023-35081, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. CVE-2023-35078 is a critical authentication bypass affecting internet-facing API paths, while CVE-2023-35081 is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment.
Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted CVE-2023-35078 as a critical API access flaw, while Ivanti later disclosed CVE-2023-35082, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious mi.war Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1395 on multiple vulnerabilities affecting Ivanti Endpoint Manager Mobile. This appears to be a later follow-up advisory continuing coverage of the product's vulnerability set.
dCERT issued advisory 2026-0252 covering multiple Ivanti Endpoint Manager Mobile vulnerabilities that could allow code execution. The advisory indicates continued downstream tracking and notification of the Ivanti EPMM flaws.
Ivanti published a blog post explaining that additional exploitation paths depended on EPMM appliance configuration and could allow remote internet-facing attackers to access PII and make limited server changes. The company said its investigation was ongoing and credited Rapid7's Stephen Fewer for coordinated disclosure assistance.
Public reporting highlighted that all supported Ivanti EPMM versions were affected by the vulnerability tied to attacks on Norwegian government entities. The coverage reflected the broadened scope of impacted versions following Ivanti's updated disclosure.
Ivanti disclosed CVE-2023-35082 on August 2, 2023, saying its understanding had expanded beyond MobileIron Core 11.2 and earlier. The company said the issue affects all EPMM 11.10, 11.9, and 11.8 versions as well as MobileIron Core 11.7 and below, and released an RPM mitigation script.
CISA and NCSC-NO issued a joint advisory describing active exploitation of CVE-2023-35078 and CVE-2023-35081 against Norwegian organizations. The advisory included technical indicators, tradecraft details, and incident response guidance, including evidence of proxying through compromised SOHO routers and likely Exchange webshell activity.
In late July 2023, CISA added both Ivanti EPMM vulnerabilities to its Known Exploited Vulnerabilities Catalog. This reflected confirmed active exploitation and increased urgency for federal and private-sector defenders to patch.
CISA published an alert highlighting Ivanti security updates for CVE-2023-35081 in EPMM. The vulnerability was described as a directory traversal issue that could let an authenticated administrator write arbitrary files, including webshells.
Rapid7 publicly detailed CVE-2023-35078 as a critical API access vulnerability in Ivanti Endpoint Manager Mobile. The publication helped document the flaw's severity and exploitation risk.
Ivanti released security updates for Ivanti Endpoint Manager Mobile to address CVE-2023-35078, a critical authentication bypass vulnerability. The flaw allowed unauthenticated access to sensitive API paths and exposure of user and device-management data.
According to the joint CISA and NCSC-NO advisory, threat actors exploited Ivanti EPMM vulnerability CVE-2023-35078 from at least April 2023. The activity targeted several Norwegian organizations and ultimately contributed to the compromise of a Norwegian government agency.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourceivanti.com
Open sourcetherecord.media
Open sourcecisa.gov
Open sourcerapid7.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti disclosed two **critical, actively exploited** Ivanti Endpoint Manager Mobile (*EPMM*) vulnerabilities—**CVE-2026-1281** and **CVE-2026-1340**—described as unauthenticated code-injection issues enabling **remote code execution (RCE)** with a **CVSS 9.8** rating. Ivanti reported exploitation affecting a *very limited number* of customers at disclosure and warned that successful compromise of the EPMM appliance could expose sensitive data stored in the platform (e.g., admin/user details and managed-device metadata such as phone numbers, IPs, installed apps, and identifiers like IMEI/MAC), and potentially allow attackers to change device configurations via the API or web console, including authentication-related settings. Guidance from national cybersecurity authorities emphasized that EPMM’s role in mobile device management can make it a pivot point into internal environments, potentially enabling lateral movement if the appliance is compromised. Affected versions include EPMM **12.5.x, 12.6.x, and 12.7.x** (including **12.5.1.0** and **12.6.1.0** and earlier as specified), while Ivanti’s cloud offerings (e.g., *Ivanti Neurons for MDM*) and *Ivanti Endpoint Manager (EPM)* are not impacted. Ivanti provided interim mitigations/hotfixes (RPM-based) with the caveat that hotfixes may need reapplication after upgrades, and indicated a permanent fix is expected in **EPMM 12.8.0.0**; organizations were advised to patch immediately and review appliances for compromise indicators such as anomalous logs and unexpected admin/configuration changes.
Jun 29, 2026
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
Jun 29, 2026
Ivanti warned that its on-premises **Endpoint Manager Mobile (EPMM)** product contains two critical vulnerabilities, **`CVE-2026-1281`** and **`CVE-2026-1340`**, that can let an unauthenticated remote attacker execute arbitrary commands or code over the network. The flaws affect exposed EPMM servers and create a path to full server compromise and possible lateral movement into internal environments. Ivanti said its cloud offerings, including **Ivanti Neurons for MDM**, and the separate **Ivanti Endpoint Manager (EPM)** product are not affected, and it released patches, incident-response guidance, and a detection tool to help customers assess exposure and compromise. Follow-up advisories said the vulnerabilities are being **actively exploited**, prompting defenders to inspect EPMM systems for anomalous logs, unauthorized administrator-account changes, and suspicious device-configuration modifications. A later update citing Germany's **BSI** said exploitation may date back to **summer 2025**, expanding the scope of required forensic review beyond recent activity. Public reporting from security researchers, including Palo Alto Networks Unit 42 and vulnerability tracking sources, reinforced that the issue is an unauthenticated remote code execution risk requiring immediate patching and retrospective compromise hunting on affected on-premises deployments.
Jun 29, 2026