https://pwn.watch/t/epmm Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 15 Aug 2023 00:00:00 GMT https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078 https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078 Tue, 15 Aug 2023 00:00:00 GMT critical <p>APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD), CVE-2023-35078: see vendor advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2023-08-15: Norway shuts down the old ministry e-mail solution and rolls out a new one (<a href="https://www.regjeringen.no/en/whats-new/shutdown-of-e-mail-solution-following-cyberattack/id2991023/">source</a>)</li><li>2023-08-01: CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023 (<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a">source</a>)</li><li>2023-07-28: Ivanti patches the second bug, CVE-2023-35081</li></ul> <p><strong>CVEs:</strong> CVE-2023-35078, CVE-2023-35081</p>