At Ivanti, our top priority is upholding our commitment to deliver and maintain secure products. We continue to invest significant resources to ensure that all our solutions continue to meet our own high standards.

A vulnerability has been discovered in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. We will be reporting this as CVE-2023-35078. This vulnerability impacts all supported versions – Version 11.4 releases 11.10, 11.9 and 11.8. Older versions/releases are also at risk. 

Upon learning of the vulnerability, we immediately mobilized resources to fix the problem and have a patch available now for supported versions of the product. For customers on an earlier version, we have an RPM script to assist in remediation. 

More detailed information is available in this Security Advisory.  

Exploitation of this vulnerability may allow: 

An unauthorized, remote (internet-facing) actor to access users’ personally identifiable information. 

Limited changes to the server. 

We are only aware of a very limited number of customers that have been impacted. We are actively working with our customers and partners to investigate this situation.  As always, our top priority is upholding our commitment to deliver and maintain secure products to you. We continually assess, validate and monitor the security posture of all our solutions. 

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required). 

Ivanti would like to thank mnemonic for their assistance in identifying this vulnerability. We also appreciate our partners at CISA, ACSC, and NCSC-NO for partnership in coordinated disclosure.