Loading story…
Ivanti disclosed CVE-2023-35081, a high-severity remote file write vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that affects supported versions 11.10, 11.9, and 11.8, with older releases also considered at risk. The flaw carries a CVSS score of 7.2 and was patched by Ivanti after coordinated disclosure.
Security reporting said attackers have exploited CVE-2023-35081 together with CVE-2023-35078 to write malicious JSP and Java .class files to vulnerable EPMM servers. Those files were then loaded by Apache Tomcat, allowing remote execution of attacker-supplied Java bytecode. CISA and Norway’s NCSC-NO issued a joint advisory on active exploitation, and CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA and Norway’s National Cyber Security Centre issued a joint advisory titled “Threat Actors Exploiting Ivanti EPMM Vulnerabilities” covering active exploitation of CVE-2023-35078 and CVE-2023-35081. The advisory included indicators of compromise and tactics, techniques, and procedures.
Ivanti disclosed CVE-2023-35081, a high-severity remote file write vulnerability in Ivanti Endpoint Manager Mobile, and released a patch in coordination with its disclosure. Ivanti said supported EPMM versions 11.10, 11.9, and 11.8 were affected, with older releases also at risk.
CISA added both CVE-2023-35078 and CVE-2023-35081 to its Known Exploited Vulnerabilities Catalog after exploitation was observed. The references do not provide an explicit date for these catalog additions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
Jun 29, 2026
Ivanti disclosed five vulnerabilities in **Endpoint Manager Mobile (EPMM)**, including **`CVE-2026-6973`**, an authenticated remote code execution flaw with a **CVSS 7.2** score that the company said has been exploited against a very limited number of customers. The issue requires administrative authentication, and Ivanti said organizations that rotated credentials after the earlier January flaws **`CVE-2026-1281`** and **`CVE-2026-1340`** have significantly reduced risk. CERT-SE separately highlighted that **`CVE-2026-6973`** was added to **CISA’s Known Exploited Vulnerabilities** catalog. The advisory also covers **`CVE-2026-5786`**, **`CVE-2026-5787`**, **`CVE-2026-5788`**, and **`CVE-2026-7821`**, with Ivanti reporting no known exploitation for those issues at disclosure time. According to the vendor and CERT-SE, the additional flaws include weaknesses that can enable administrative privilege gain and unauthenticated certificate access, while **`CVE-2026-7821`** affects only environments using **Apple Device Enrollment**. Ivanti urged customers to rotate administrative credentials and upgrade EPMM to **12.6.1.1**, **12.7.0.1**, or **12.8.0.1**; it also released compatible **Sentry** versions, while stating that Sentry itself is not affected.
Jul 24, 2026