The U.S Cybersecurity and Infrastructure Security Agency (CISA) released an urgent alert after Ivanti disclosed two (2) critical vulnerabilities impacting their Endpoint Manager Mobile (EPMM) solution. These flaws are under active exploitation by threat actors attacking Norwegian government agencies. Ivanti’s Endpoint Manager Mobile is a mobile management software engine that allows organization IT administrators to set policies for mobile devices, applications, and content. The first vulnerability, tracked as CVE-2023-35078, is a critical remote authentication bypass vulnerability, allowing unauthenticated remote attackers to add administrative EPMM accounts, pilfer personally identifiable information (PII), and change critical configuration settings after bypassing security to obtain access to the API. The second vulnerability, tracked as CVE-2023-35081, is a path traversal flaw that allows unauthenticated threat actors to perform arbitrary file writes to the EPMM server. CVE-2023-35081 can be chained to CVE-2023-35078, allowing the attacker to bypass authentication and then perform arbitrary file writes to the EPMM server. According to Ivanti, “Successful exploitation can be used to write malicious files to the appliance, ultimately allowing a malicious actor to execute OS commands on the appliance as the tomcat user.” According to Shodan scans, more than 2,600 EPMM user portals are currently exposed to the public internet, with nineteen (19) of them linked to U.S. local and state government agencies. The technical details of the attack have not been made public yet, allowing as many organizations as possible to become compliant and protect themselves from exploitation. CTIX analysts urge all Ivanti EPMM administrators to ensure they are running the latest secure versions of the software solution to prevent future exploitation of these vulnerabilities.