Norwegian government Ivanti zero-day breach

On 24 July 2023, Norwegian authorities disclosed that attackers had exploited a zero-day vulnerability in Ivanti Endpoint Manager Mobile (EPMM) — software used to manage mobile devices — to breach a shared ICT platform serving 12 Norwegian government ministries. It was one of the most significant intrusions into central government infrastructure in Norway's history and an early flashpoint in a wave of Ivanti exploitation that would batter governments worldwide.

What happened

The flaw, CVE-2023-35078, is an authentication-bypass vulnerability allowing remote, unauthenticated access to specific API paths in Ivanti EPMM (formerly MobileIron Core). It carries the maximum CVSS score of 10.0. An attacker reaching those paths could read personally identifiable information — names, phone numbers, device details — for managed users, and could create administrative accounts to deepen control of the system.

The compromised platform, operated by the Norwegian Government Security and Service Organisation (DSS), provided IT services to a dozen ministries. Authorities emphasized that the most sensitive bodies — the Prime Minister's Office, the Ministry of Defence, the Ministry of Justice, and the Ministry of Foreign Affairs — ran on separate infrastructure and were not affected.

Subsequent forensic analysis indicated the zero-day had been exploited against the Norwegian platform since at least April 2023, giving the attackers months of undetected access before the flaw was publicly known.

The second zero-day

On 2 August 2023, Ivanti confirmed that a second zero-day, CVE-2023-35081, had been chained with CVE-2023-35078 in the Norwegian attack. The combination let attackers bypass authentication and access-control restrictions, then write malicious files (such as web shells) to the appliance. Both flaws were added to CISA's Known Exploited Vulnerabilities catalog as opportunistic scanning and exploitation spread globally.

Impact

• Communications networks at 12 ministries were affected, disrupting employees' access to mobile services and email.
• Norway's national security authorities treated the breach as a serious compromise of government infrastructure and coordinated emergency patching across affected systems.
• No public attribution to a specific nation-state was confirmed, though the targeting of central government and the months-long dwell time pointed to an advanced actor.

Why it matters

The Norwegian government breach was a defining example of the risk concentrated in security and device-management products: the very tools meant to protect and administer government fleets became the single point of catastrophic failure. It helped trigger global emergency directives on Ivanti products and reinforced a hard lesson — internet-facing management appliances must be patched on a zero-day footing, because a single authentication bypass can expose an entire government's mobile estate.