---
title: "Ivanti EPMM/MobileIron CVE-2023-35082: Unauth API Access"
url: https://erroneo.us/security/briefs/ivanti-epmm-mobileiron-cve-2023-35082-api-bypass-kev/
description: "Unauthenticated API access in MobileIron Core 11.7 and older and EPMM 11.8-11.10, bypassing CVE-2023-35078. Fixed in 11.11; Core 11.2 never will be."
type: security-brief
section: "Security Digest"
date_published: 2023-08-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-35082"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti EPMM/MobileIron CVE-2023-35082: Unauth API Access

**Verdict: Check exposure.** EPMM 11.11 and every later release are not affected; any MobileIron Core or EPMM server still on 11.10 or older, above all Core 11.2 and earlier, which will never be fixed, should be upgraded or taken offline.

- **Who must act:** Anyone still running on-premises MobileIron Core 11.7 or earlier, or EPMM 11.8 to 11.10 without Ivanti's RPM fix, especially where the server is reachable from the internet.
- **Who can relax:** Organizations on EPMM 11.11 or any later release, and users of other Ivanti products, which Ivanti says are not affected.
- **Affected:** MobileIron Core 11.2 and earlier (out of support since Mar 15, 2022; no fix will be issued); MobileIron Core 11.3 to 11.7; Ivanti EPMM 11.8, 11.9 and 11.10
- **Fixed:** Ivanti EPMM 11.11.0.0 and later; RPM script for 11.3 to 11.10 (older versions must upgrade to 11.10 first)
- **CVEs:** CVE-2023-35082
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every on-premises MobileIron Core and EPMM server and record its version.
2. Upgrade to a current EPMM release; on 11.3 to 11.10, apply Ivanti's RPM script only as a stopgap.
3. Retire MobileIron Core 11.2 and older, or take it off the internet until it is replaced; Ivanti will not fix it.
4. From an internal host, check that curl -k https://<epmm-host>/mifs/asfV3/api/v2/ping returns 401 or 403, not JSON.
5. Hunt the Apache logs for the request paths below; if you find hits, rebuild the server and rotate the credentials it holds.

### How to check if you are affected

- grep /var/log/httpd/http-access_log for /mifs/asfV3/api/v2/ requests with HTTP 200 responses; 401 or 403 means the attempt was blocked.
- Check /var/log/httpd/http-request_log for the same path.
- Also search for /mifs/aad/api/v2/, the path used to exploit the related CVE-2023-35078.
- Look for unexpected files on the appliance, since chaining with CVE-2023-35081 can write web shells.

## What happened

In July 2023, CISA put CVE-2023-35078, an unauthenticated API access flaw in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), in its exploited-vulnerabilities catalog. While testing Ivanti's hotfix for it, Stephen Fewer of Rapid7 found a way around the fix and reported it on July 26. Ivanti and [Rapid7](https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/) disclosed it as CVE-2023-35082 on August 2, 2023. The hotfix blocks unauthenticated requests under `/mifs/aad/api/v2/`, but the same requests still work under `/mifs/asfV3/api/v2/`. Rapid7 traced both to overly permissive entries in the mifs security filter chain. An attacker can call the API to read personal data and make changes to the server. Chained with CVE-2023-35081, it can write a web shell.

Ivanti's [advisory](https://hub.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US) first said only Core 11.2 and older were affected, because the bug was "incidentally resolved" in 11.3. Then Florian Hauser of CODE WHITE found EPMM 11.10 vulnerable in a specific configuration. On August 7, Ivanti widened the scope to EPMM 11.8 to 11.10 and Core 11.7 and below, and shipped an RPM script for 11.3 to 11.10. EPMM 11.11.0.0 fixed it on August 21. Ivanti scores it 10.0; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-35082) gives 9.8.

CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082) on January 18, 2024, five months later, without describing the attacks. Ivanti's knowledge base had already said in August 2023 that "a few customers" were exploited after Rapid7 published details, as [Help Net Security](https://www.helpnetsecurity.com/2024/01/19/exploited-cve-2023-35082/) reported. CISA's catalog now marks the bug as known to be used in ransomware campaigns, without naming a group.

## Who is affected

On-premises MobileIron Core 11.7 and earlier and EPMM 11.8, 11.9 and 11.10, according to Ivanti and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-35082). Core 11.2 has been out of support since March 15, 2022. Ivanti says it will not issue an RPM script or any other fix for 11.2 or earlier, so upgrading is the only remedy.

## Do you really need to act?

Not if you run EPMM 11.11 or later, which covers every release since August 2023. Worry about stragglers: an MDM box nobody upgraded, especially Core 11.2 or older, which cannot be fixed. It holds device inventories and user data, can push configuration to phones, and the bug needs only network access. If one is still running, upgrade it or take it offline. For the EPMM bugs that matter on current releases, see our brief on [CVE-2026-1281 and CVE-2026-1340](https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/).

## What to do now

1. Inventory every MobileIron Core and EPMM server and its version.
2. Upgrade to a current EPMM release. On 11.3 to 11.10, Ivanti's RPM script is a stopgap; versions older than 11.3 must reach 11.10 before it applies.
3. Retire MobileIron Core 11.2 and older, or cut it off from the internet until it is replaced.
4. From an internal host, run Rapid7's check: `curl -k https://<epmm-host>/mifs/asfV3/api/v2/ping`. A JSON reply with `apiVersion` means unauthenticated access works. HTTP 401 or 403 means it is blocked.

## How to tell if you were hit

Rapid7 lists indicators in the appliance's Apache logs. In `/var/log/httpd/http-access_log`, a request containing `/mifs/asfV3/api/v2/` with response code 200 is a successful exploit; 401 or 403 means it was blocked. The same path appears in `/var/log/httpd/http-request_log`. Run `grep '/mifs/asfV3/api/v2/' /var/log/httpd/http-access_log*`, then repeat for `/mifs/aad/api/v2/`, the CVE-2023-35078 path. Because CVE-2023-35081 can be chained to write files, look for unfamiliar files too. If you find hits, rebuild the server and rotate the directory, certificate and API credentials it stores.

## Timeline

- Jul 25, 2023 — CISA adds the original bug, CVE-2023-35078, to KEV.
- Jul 26, 2023 — Rapid7 reports the bypass to Ivanti.
- Aug 2, 2023 — Ivanti and Rapid7 disclose CVE-2023-35082, initially for Core 11.2 and older.
- Aug 7, 2023 — Ivanti widens the scope to EPMM 11.8 to 11.10 and Core 11.7 and below, and releases an RPM script.
- Aug 21, 2023 — EPMM 11.11.0.0 includes the fix.
- Jan 18, 2024 — CISA adds CVE-2023-35082 to KEV, with a February 8 federal deadline.

## Sources

1. [Ivanti — CVE-2023-35082: Remote Unauthenticated API Access Vulnerability in MobileIron Core 11.2 and older](https://hub.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US)
2. [Rapid7 — CVE-2023-35082: MobileIron Core Unauthenticated API Access Vulnerability](https://www.rapid7.com/blog/post/2023/08/02/cve-2023-35082-mobileiron-core-unauthenticated-api-access-vulnerability/)
3. [CVE record — CVE-2023-35082](https://www.cve.org/CVERecord?id=CVE-2023-35082)
4. [NVD — CVE-2023-35082](https://nvd.nist.gov/vuln/detail/CVE-2023-35082)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-35082](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35082)
6. [Help Net Security — Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms](https://www.helpnetsecurity.com/2024/01/19/exploited-cve-2023-35082/)

---
Source page: https://erroneo.us/security/briefs/ivanti-epmm-mobileiron-cve-2023-35082-api-bypass-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt