Is CVE-2023-35081 actively exploited?

Yes. CVE-2023-35081 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-35081 be exploited remotely?

The attack vector of CVE-2023-35081 has not been classified yet.

What is the CVSS score of CVE-2023-35081?

CVE-2023-35081 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-35081

HIGHCISA KEVIN THE WILD

CVE-2023-35081

Published: July 31, 2023

EPSS:91.09%probability of exploitation in 30 daysPercentile:99.6th

Official Description

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

NVD Source

CISA KEV Advisory

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

Added to KEV: 2023-07-31Federal patch deadline: 2023-08-21

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows an authenticated administrator to write malicious files to the server. This path traversal flaw is considered high severity and has a very high exploitation likelihood (EPSS 0.91092). Its presence in CISA's KEV catalog confirms active exploitation, making it an urgent concern.

Active exploitation of this vulnerability has been observed in the wild. It can be chained with CVE-2023-35078 to bypass authentication and access controls, increasing its impact.

Recommended Action

Organizations using Ivanti EPMM should apply the latest security updates immediately. Ensure all administrative accounts follow strong password policies and least privilege principles.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-35081 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-35081 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.