Authentication Bypass (CVE‑2023‑35082) in Ivanti Endpoint Manager Mobile and MobileIron Core
What It Is — Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication‑bypass flaw that permits an unauthenticated user to reach functions and data that should be restricted to legitimate administrators.
Exploitability — The vulnerability is publicly disclosed; no public exploit code has been released, but the flaw is trivial to weaponise once an attacker can send crafted requests to the management API. CVSS v3.1 base score 8.8 (High).
Affected Products — Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication controls remain effective after updates or configuration changes.
- A successful bypass erodes the audit trail that regulators expect for privileged‑access activity, weakening evidentiary support during assessments.
- Enterprises that must prove “defensible evidence” of access governance (e.g., under NIST CSF 2.0) will be asked to show that such critical controls are monitored and remediated promptly.
Recommended Actions
- Apply Ivanti’s security patch for CVE‑2023‑35082 immediately.
- Review and harden authentication policies for EPMM and MobileIron Core (enforce MFA, limit admin IP ranges).
- Enable detailed logging of all management‑API calls and integrate them with a SIEM for real‑time anomaly detection.
- Conduct a post‑patch validation test to confirm the bypass is closed.
- Update your control‑mapping inventory to reflect the remediation and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2023‑35082