Ivanti EPMM/MobileIron CVE-2023-35082: Unauth API Access
EPMM 11.11 and every later release are not affected; any MobileIron Core or EPMM server still on 11.10 or older, above all Core 11.2 and earlier, which will never be fixed, should be upgraded or taken offline.
Must act: Anyone still running on-premises MobileIron Core 11.7 or earlier, or EPMM 11.8 to 11.10 without Ivanti's RPM fix, especially where the server is reachable from the internet.
Can relax: Organizations on EPMM 11.11 or any later release, and users of other Ivanti products, which Ivanti says are not affected.
- Find every on-premises MobileIron Core and EPMM server and record its version.
- Upgrade to a current EPMM release; on 11.3 to 11.10, apply Ivanti's RPM script only as a stopgap.
- Retire MobileIron Core 11.2 and older, or take it off the internet until it is replaced; Ivanti will not fix it.