CVE-2023-35078
A permanent, source-backed tracker page. Values are shown only when returned; explicit gaps and read failures remain different states.
What it is
ReportedIvanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. Source description excerpt; complete tracked detail loads below.
NVD published: Jul 25, 2023 · Source record updated: Aug 8, 2026 · Tracker snapshot: Aug 8, 2026
What is affected
ReportedIvanti — Endpoint Manager Mobile (EPMM). Product-level identification only; no affected-version conclusion is available from this field.
NVD published: Jul 25, 2023 · Source record updated: Aug 8, 2026 · Tracker snapshot: Aug 8, 2026
Urgency and basis
ReportedAct now · 571.4
Tracker decision tier from the evidence detailed below · Source record updated: Aug 8, 2026 · Tracker snapshot: Aug 8, 2026
Exploitation evidence
ReportedActive exploitation · CISA KEV · VulnCheck KEV · ENISA exploited-vulnerability catalog
Active since: Jul 25, 2023 · CISA KEV added: Jul 25, 2023 · VulnCheck KEV added: Jul 24, 2023 · ENISA added: Jul 25, 2023 · Source record updated: Aug 8, 2026 · Tracker snapshot: Aug 8, 2026
What to do
ReportedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source remediation ↗Tracked source remediation field · Source record updated: Aug 8, 2026 · Tracker snapshot: Aug 8, 2026
Evidence detail
Loading the full tracker evidence record…