Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) CVE-2023-35078 (unauthenticated authentication bypass / API access, CISA KEV): which versions are fixed and what should I do if it was exposed?

What it is: CVE-2023-35078 is an authentication bypass in Ivanti EPMM (formerly MobileIron Core) that lets an unauthenticated remote party reach restricted functionality and API resources. Ivanti disclosed it in July 2023; Ivanti said it could expose personally identifiable information of managed users and allow limited changes to the server. NVD scores it 9.8 (critical). CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 25, 2023. Am I affected: - Self-hosted EPMM / MobileIron Core. Ivanti's blog names supported releases 11.10, 11.9 and 11.8 and says older versions are also at risk. - NVD lists as vulnerable: versions before 11.8.1.1, 11.9.x before 11.9.1.1, and 11.10.x before 11.10.0.2. - Check the version in the EPMM admin portal and note whether the admin/API interfaces were reachable from the internet. Fix: 1. Apply the vendor patch for your supported release (11.8.1.1, 11.9.1.1 or 11.10.0.2 or later per NVD), or move to a current supported EPMM release. Ivanti provided an RPM script for customers on older, unsupported versions; the better path is to upgrade to a supported release. 2. Restrict access to the EPMM admin and API interfaces to trusted networks or VPN rather than the open internet. 3. If the system was internet-exposed and unpatched, treat it as possibly compromised: review web and API access logs for unexpected requests, check for new or changed administrator accounts, configuration policies and pushed profiles, and review what device and user data was reachable. Rotate credentials and secrets stored in or used by EPMM (admin accounts, LDAP/AD service accounts, certificates, API keys) and consider rebuilding from a known-good state if tampering is found. Contact Ivanti Support for guidance. Verify: the EPMM version shows a fixed release, the admin and API interfaces are not reachable from untrusted networks, and no unknown administrators or policies exist. Sources: https://nvd.nist.gov/vuln/detail/CVE-2023-35078 https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog