Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-35078

CVE-2023-35078CRITICAL

Ivanti Endpoint Manager Mobile (EPMM)

  AV  AC  PR  UI  S  C  I  A   CVSS     EPSS    %ile   KEV
   N   L   N   N  U  H  H  H    9.8   1.0000   100.0   YES

AFFECTED
  Product                  Versions     Fixed
  Endpoint Manager Mobile  unspecified  11.10

TIMELINE
  Jun 13  Reserved by hackerone
  Jul 25  Added to CISA KEV, remediation due 2023-08-15
  Jul 25  Published (CNA: hackerone)
  Aug 4   PATCH SHIPPED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Fixed in Endpoint Manager Mobile 11.10.
  Aug 5   EXPLOIT PUBLISHED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Public exploit reference added.
  Aug 5   RESCORED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). CVSS 10 → 9.8 (NVD).

CWE-287 · CNA: hackerone · CVSS v3.1 · 5 references · NVD status: Analyzed · KEV due August 15, 2023

Description

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
June 13, 2023	Reserved	Reserved by hackerone
July 25, 2023	KEV ADDED	Added to CISA KEV, remediation due 2023-08-15
July 25, 2023	Published	Published (CNA: hackerone)
August 4, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Fixed in Endpoint Manager Mobile 11.10.
August 5, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Public exploit reference added.
August 5, 2026	RESCORED	RESCORED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). CVSS 10 → 9.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Ivanti	Endpoint Manager Mobile	—	—	11.10

Weaknesses

CWE-287

References (5)

https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability [Vendor Advisory]
https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078 [Exploit, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078 [US Government Resource]
https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078 [Third Party Advisory, US Government Resource]
https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability [Vendor Advisory]

Authoritative record: CVE-2023-35078 at cve.org

Vendors: ivanti

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-35078 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.