CVE-2023-35078

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

• CWE-287
• CWE-287

• https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerabilityVendor Advisory
• https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078Exploit, Vendor Advisory
• https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078Third Party Advisory, US Government Resource
• https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerabilityVendor Advisory
• https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerabilityVendor Advisory
• https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078Exploit, Vendor Advisory
• https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078Third Party Advisory, US Government Resource
• https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerabilityVendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078US Government Resource

Published

Jul 25, 2023

Last Modified

Aug 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35071Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-35072Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-35073Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-35074The issue was addressed with improved memory handling. This …8.8
• CVE-2023-35075Mattermost fails to use  innerText / textContent when settin…5.4
• CVE-2023-35077An out-of-bounds write vulnerability on windows operating sy…7.5
• CVE-2023-3508The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has…6.5
• CVE-2023-35080A vulnerability has been identified in the Ivanti Secure Acc…7.8
• CVE-2023-35081A path traversal vulnerability in Ivanti EPMM versions (11.1…7.2
• CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 …9.8
• CVE-2023-35083Allows an authenticated attacker with network access to read…6.5
• CVE-2023-35084Unsafe Deserialization of User Input could lead to Execution…9.8