CVE-2023-35082: critical vulnerability in Ivanti EPMM
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Ivanti EPMM version 11.10 and older lets attackers access protected features and data without logging in. This is a critical security issue because it completely bypasses the login system.
An authentication bypass vulnerability in Ivanti EPMM ≤11.10 allows unauthenticated attackers to gain unauthorized access to restricted functionality and resources. The vulnerability enables direct access to protected application features without valid credentials, resulting in complete compromise of authentication controls and potential data exposure.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.