VulnerabilitycriticalExploited in the wild

U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability

The Hacker Newsby @TheHackersNewsJan 20, 2024 · 04:42 UTC (Jan 20, 2024)3 min read2

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-35082 CVE-2023-35078 CVE-2023-35081 CVE-2023-46805 CVE-2024-21887

Tags: cve-2023-35082 cve-2023-35078 cve-2023-35081 cve-2023-46805 cve-2024-21887 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-35078	Authentication Bypass in Ivanti Endpoint Manager Mobile (EPMM) Exposes PII	9.8	100%	KEVRansomwarePoC	Jul 25, 2023 KEV Jul 25, 2023
CVE-2023-35081	Authenticated Path Traversal in Ivanti Endpoint Manager Mobile (EPMM)	7.2	64%	KEV	Aug 3, 2023 KEV Jul 31, 2023
CVE-2023-35082	Authentication Bypass in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core	9.8	100%	KEVRansomware	Aug 15, 2023 KEV Jan 18, 2024
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024

From the original article

3 min read at thehackernews.com

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched critical flaw impacting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core to its Known Exploited Vulnerabilities ( KEV ) catalog, stating it's being actively exploited in the wild.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.