Ivanti, an IT software solution provider, informed its customers of a critical vulnerability in their MobileIron Core mobile device management software. If successfully exploited, this vulnerability could allow unauthorized remote attackers to access the API endpoints on an exposed management server. This would allow the threat actor to access sensitive personally identifiable information (PII) as well as make configuration changes and chain the vulnerability with other flaws to compromise servers by installing web shell backdoors. MobileIron Core is a comprehensive security and Unified Endpoint Management (UEM) tool including mobile device management (MDM), mobile application management (MAM), and mobile content management (MCM). With MobileIron Core, administrators can securely manage the lifecycle of mobile devices and mobile applications, from registering devices, to retiring devices. The flaw, tracked as CVE-2023-35082, is described as a remote authentication bypass API access vulnerability affecting MobileIron Core version 11.2 and previous versions. The researchers who discovered the vulnerability have provided indicators of compromise (IOC) to help network defenders to detect the signs of exploitation, which can be viewed in the report linked below. This platform is very popular and according to Shodan scans, there are more than 2,200 MobileIron user portals currently exposed to the public internet as well as “over a dozen connected to U.S. local and state government agencies.” MobileIron Core 11.2 will not be patched since it has been out of support since March 15, 2022. CTIX analysts urge all vulnerable users to upgrade to Ivanti’s latest rebrand called Ivanti Endpoint Manager Mobile (EPMM) as soon as possible to prevent exploitation.