Ivanti Endpoint Manager Absolute Path Traversal (CVE-2024-13159)

Historical catalog analysis: CISA added this entry on March 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-13159 is an absolute path traversal vulnerability (CWE-36) affecting Ivanti Endpoint Manager (EPM). The flaw allows a remote, unauthenticated attacker to access and leak sensitive information from the system by bypassing intended directory restrictions.

Exposure and applicability

This vulnerability applies to organizations deploying Ivanti Endpoint Manager. Because the exploit does not require authentication, any EPM instance exposed to an untrusted network—or accessible to an internal adversary—is at risk of unauthorized data disclosure. The impact is centered on the confidentiality of sensitive information stored on the host system.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions:

1. Asset Identification: Immediately identify all active Ivanti EPM deployments across the environment to determine the scope of exposure.
2. Vendor Mitigation Application: Apply the specific mitigations provided in the vendor’s security advisory for EPM 2024 and EPM 2022 SU6.
3. Cloud Service Review: For organizations utilizing cloud-based deployments, review configurations against BOD 22-01 guidance to ensure appropriate exposure management.
4. Decommissioning Evaluation: In instances where vendor mitigations cannot be applied or are unavailable for a specific legacy version, evaluate the risk of continued use versus discontinuing the product.

How to validate remediation

Verification must move beyond simple version checks, as a deployed fix does not always equate to a verified result. To assure that exposure has been reduced, defenders should:

• Confirm Mitigation State: Verify through configuration audits or vendor-provided tools that the specific path traversal mitigations are active and correctly configured.
• Test Access Controls: Use authorized security testing to attempt access to known sensitive paths (as defined by the vulnerability’s nature) to confirm that the system now denies these requests.
• Log Analysis: Monitor system logs for patterns indicative of path traversal attempts to ensure that the mitigation is not only blocking access but providing visibility into attempted exploitation.

Limits and open questions

Applying a mitigation could reduce the likelihood of successful exploitation, but it may not eliminate all residual risk associated with the underlying architecture. It remains unknown whether this vulnerability has been leveraged in ransomware campaigns. Furthermore, while CISA has established a remediation deadline for federal agencies, non-federal organizations must determine their own priority based on their specific threat model and asset criticality.

Source and editorial note

CVE-2024-13159: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability · Source date: March 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 22, 2026 at 00:44 UTC.

Request a Vulnerability Assessment