CVE-2023-35078

10.0

CVSS
Critical

PUBLISHED

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application...

Exploited in the wild Used in malware Remote Low complexity No user interaction

Vendor: Ivanti
Product: Endpoint Manager Mobile
Published: Jul 25, 2023
EPSS: —

Description

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

cisa malware ransomware nuclei_scanner edge

CVSS scores

CVSS v3.0 10.0 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2023-07-25 00:00:00 UTC · Source

Used in malware

Recorded 2023-07-25 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Jul 25, 2023

Scanner integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35078.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

raytheon0x21/CVE-2023-35078

github · Created 2023-07-31 02:24:24 UTC · 5 stars

Tools to scanner & exploit cve-2023-35078

lager1/CVE-2023-35078

github · Created 2023-07-29 19:58:33 UTC · 5 stars

Proof of concept script to check if the site is vulnerable to CVE-2023-35078

vchan-in/CVE-2023-35078-Exploit-POC

github · Created 2023-07-29 05:06:27 UTC · 117 stars

CVE-2023-35078 Remote Unauthenticated API Access Vulnerability Exploit POC

Vulnerability detail