CVE Watch—

CVE-2023-35081

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

CVSS

—

No CVSS

EPSS

63.3%

p99

KEV

YES

Jul 31, 2023

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

63.3%EPSS · 30 days63.3%

2026-06-302026-07-16

KEV catalog record

Product

Ivanti / Endpoint Manager Mobile (EPMM)

Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

Added to KEV

Jul 31, 2023

Remediate by

Aug 21, 2023

Known ransomware use

Summary description

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2023-35078—

100.0%

KEV—80Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability—CVE-2025-4427—

100.0%

KEV—80Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability—CVE-2026-1340—

99.7%

KEV—80Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability—CVE-2025-4428—

99.7%

KEV—80Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability—CVE-2026-1281—

99.6%

KEV—80Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability—CVE-2026-6973—

98.2%

KEV—79Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability—