CVE-2023-35081

Deeper analysis

A path traversal vulnerability tracked as CVE-2023-35081 affects Ivanti Endpoint Manager Mobile (EPMM) in versions 11.10.x prior to 11.10.0.3, 11.9.x prior to 11.9.1.2, and 11.8.x prior to 11.8.1.2. The flaw, assigned CWE-22, permits an authenticated administrator to write arbitrary files to the appliance, carrying a CVSS 3.1 score of 7.2 that reflects high impact on confidentiality, integrity, and availability over a network vector with low attack complexity.

An authenticated administrator can exploit the issue to upload or overwrite files on the EPMM appliance, potentially achieving remote code execution or persistence by placing malicious content in sensitive directories. Because the attack requires valid administrative credentials, the primary threat arises from compromised or malicious insider accounts rather than unauthenticated remote attackers.

Ivanti advisory documentation directs customers to apply the fixed releases 11.10.0.3, 11.9.1.2, or 11.8.1.2, while CISA has added the CVE to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The associated EPSS score has reached a peak of 0.9283 with a current value of 0.9068, indicating sustained exploitation interest following disclosure.