{"id":"CVE-2023-35081","published":"2023-08-03T18:15:11Z","modified":"2026-06-17T06:04:23Z","title":"Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability","vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","tier":"core","eol":null,"description":{"text":"A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3,  11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM), where improper limitation of pathnames lets file operations escape their intended directory. An attacker who is already authenticated as an administrator can write arbitrary files onto the appliance, and no user interaction is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:27Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.63577,"percentile":0.99213,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-07-31","dueDate":"2023-08-21","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-35081","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-07-28","exploitedFirstSeen":"2023-07-28","ransomware":false,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081","date":"2023-07-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-07-31"},{"url":"https://cisa.gov/news-events/alerts/2023/08/01/cisa-and-international-partner-ncsc-no-release-joint-cybersecurity-advisory-threat-actors-exploiting","date":"2023-08-01"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-213a","date":"2023-08-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-35081","date":"2023-11-15"},{"url":"https://www.trellix.com/advanced-research-center/threat-reports/november-2023/","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-35081","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-18&host_type=src&vulnerability=cve-2023-35081","date":"2023-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2023-35081","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2023-35081","date":"2023-11-20"}],"evidenceTotal":899,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US","tags":["Vendor Advisory"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35081","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system. This vulnerability is often used in conjunction with CVE-2023-35078 (along with others) that provides unauthenticated access, enhancing the attack's capabilities. It has been actively exploited, impacting victims by leveraging both vulnerabilities together.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through a path traversal flaw in Ivanti EPMM. Attackers initiate this vulnerability by leveraging authenticated administrative access to remotely write arbitrary files onto the server. This enables them to deploy additional payloads, potentially granting further access and compromising the system. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-39116","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39116","exploited":true,"exploitedSince":"2023-07-31","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2023-07-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081","provenance":"source"},{"date":"2023-07-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-07-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39116","provenance":"source"},{"date":"2023-08-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35081","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":62.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1191 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9921"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}