CVE-2023-35082

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

10.0 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

100.00% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-01-18, used in ransomware campaigns

Nuclei

critical · CWE-287

Published

2023-08-15

Updated

2025-10-21

Proof-of-concept exploits (1)

• Chocapikk/CVE-2023-350824★ · 2026-01-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35082.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-35080
• CVE-2023-35085
• CVE-2023-3508
• CVE-2023-35086
• CVE-2023-35078
• CVE-2023-3509