Loading story…
Ivanti disclosed CVE-2023-35078, a critical authentication bypass in Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, that affects supported 11.10, 11.9, 11.8, and 11.4 release lines, with older versions also at risk. The flaw allows an unauthenticated internet-facing attacker to reach API v2 endpoints, exposing users’ personally identifiable information and enabling limited server changes. Norway’s National Security Authority warned of the zero-day, and Ivanti released patches for supported versions along with an RPM-based mitigation for older deployments.
CISA later warned that threat actors were actively exploiting Ivanti EPMM vulnerabilities, while mnemonic reported that CVE-2023-35078 was used in the compromise of Norway’s Government Security and Service Organisation, affecting 12 ministries. Mnemonic also identified a second zero-day, CVE-2023-35081, a remote file write vulnerability, and said it was exploited in tandem with the authentication bypass. CISA and Norway’s NCSC-NO issued joint guidance, and both flaws were added to CISA’s Known Exploited Vulnerabilities catalog as defenders were urged to patch exposed systems and review logs for suspicious API path manipulation.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Mnemonic reported discovering a second zero-day in Ivanti EPMM, CVE-2023-35081, and observed it being actively exploited together with CVE-2023-35078. The flaw is a remote file write vulnerability.
CISA and Norway’s National Cyber Security Centre released a joint advisory titled "Threat Actors Exploiting Ivanti EPMM Vulnerabilities" covering active exploitation of CVE-2023-35078 and CVE-2023-35081. The advisory included indicators of compromise and TTPs.
Ivanti publicly disclosed a second Ivanti EPMM zero-day vulnerability, CVE-2023-35081, a remote file write flaw. A patch was made available for the issue.
Ivanti disclosed the Ivanti EPMM vulnerability CVE-2023-35078, saying it affects supported 11.10, 11.9, 11.8, and 11.4 release lines as well as older versions. The company released patches for supported versions and an RPM remediation script for earlier versions, and said exploitation could expose users’ personally identifiable information and allow limited server changes.
The Norwegian Government Security and Service Organisation (DSS) and the Norwegian National Security Authority (NSM) publicly disclosed that a zero-day vulnerability had been exploited in an attack on DSS. The attack affected 12 Norwegian ministries.
The Dutch National Cyber Security Centre warned that CVE-2023-35078 in Ivanti Endpoint Manager Mobile was being exploited on a limited scale and urged organizations to install Ivanti's security updates. It reported roughly 2,900 internet-exposed EPMM instances, including an estimated 80 in the Netherlands, and noted exploitation could expose sensitive data or lead to full system compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 198 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
mnemonic.io
Open sourcensm.no
Open sourcecisa.gov
Open sourcencsc.nl
Open sourcensm.no
Open sourceivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026
Ivanti warned that two critical zero-day flaws in **Endpoint Manager Mobile (EPMM)** — `CVE-2026-1281` and `CVE-2026-1340` — were being actively exploited, and subsequent reporting described rapid mass exploitation after proof-of-concept code became public. The attacks hit internet-facing EPMM systems used to manage mobile devices, with incident responders documenting a fully automated intrusion chain that successfully exfiltrated sensitive EPMM data and leveraged lesser-known product behaviors alongside an open-source offensive framework. Germany's BSI also issued an alert on active attacks, underscoring the broad operational impact of the campaign. The exploitation wave affected both opportunistic victims and targeted organizations, including governments. Dutch authorities disclosed that attackers had maintained access to the Dutch Custodial Institutions Agency's EPMM server for about five months, exposing employee names, email addresses, phone numbers, and location data, with officials warning of elevated blackmail and extortion risks. Ivanti's earlier handling of **EPMM** flaws, including `CVE-2023-35082`, had already shown that internet-exposed deployments could enable unauthorized access to personally identifiable information, but the company separately clarified that a later May 2026 advisory for **Endpoint Manager (EPM)** — covering `CVE-2026-8109`, `CVE-2026-8110`, and `CVE-2026-8111` — involved a different product and was not tied to the EPMM zero-day exploitation.
Aug 31, 2026
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
Jun 29, 2026