{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "epmm",
    "label": "EPMM",
    "isStack": false,
    "url": "https://pwn.watch/t/epmm",
    "feed": "https://pwn.watch/t/epmm/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "ivanti-epmm-norway-government-cve-2023-35078",
      "title": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078",
      "json": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)",
      "tags": [
        "ivanti",
        "epmm",
        "mobileiron",
        "zero-day",
        "auth-bypass",
        "norway",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-35078",
        "CVE-2023-35081"
      ],
      "affectedVersions": [
        "CVE-2023-35078: see vendor advisory",
        "CVE-2023-35081: 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2 (NVD)"
      ],
      "fixedVersions": [
        "CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD)",
        "CVE-2023-35078: see vendor advisory"
      ],
      "startedAt": "2023-07-24",
      "closedAt": "2023-08-15",
      "updatedAt": "2023-08-15",
      "summary": "APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-15",
      "title": "Norway shuts down the old ministry e-mail solution and rolls out a new one",
      "body": null,
      "sourceUrl": "https://www.regjeringen.no/en/whats-new/shutdown-of-e-mail-solution-following-cyberattack/id2991023/",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-01",
      "title": "CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-28",
      "title": "Ivanti patches the second bug, CVE-2023-35081",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-25",
      "title": "CISA adds CVE-2023-35078 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-24",
      "title": "Norway: cyber-attack on the ICT platform used by 12 ministries through a zero-day in a supplier's software",
      "body": null,
      "sourceUrl": "https://www.regjeringen.no/en/whats-new/ministries-hit-by-cyber-attacks/id2990098/",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    },
    {
      "incident": "ivanti-epmm-norway-government-cve-2023-35078",
      "incidentTitle": "Ivanti EPMM zero-days used to breach 12 Norwegian ministries",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-23",
      "title": "Ivanti patches CVE-2023-35078",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a",
      "url": "https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078"
    }
  ]
}