Ivanti EPMM Flaws Enabled Zero-Day Intrusions and Remote Code Execution

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, CVE-2023-35078 and CVE-2023-35081, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. CVE-2023-35078 is a critical authentication bypass affecting internet-facing API paths, while CVE-2023-35081 is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment.

Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted CVE-2023-35078 as a critical API access flaw, while Ivanti later disclosed CVE-2023-35082, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious mi.war Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.