Ivanti Endpoint Manager Absolute Path Traversal (CVE-2024-13160)

Historical catalog analysis: CISA added this entry on March 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-13160 is an absolute path traversal vulnerability (CWE-36) identified in Ivanti Endpoint Manager (EPM). This flaw allows a remote, unauthenticated attacker to access and leak sensitive information from the affected system. Because the vulnerability does not require prior authentication, it increases the exposure of the EPM environment to external actors.

Exposure and applicability

This vulnerability applies to organizations deploying Ivanti Endpoint Manager (EPM). The primary exposure path is remote access to the EPM service; an attacker can leverage absolute path traversal to bypass intended directory restrictions and retrieve files they are not authorized to access.

For U.S. federal agencies, this vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of March 10, 2025, with a mandatory remediation deadline of March 31, 2025. While this specific deadline is a regulatory requirement for covered federal agencies, it serves as a high-priority signal for all infrastructure owners using the product.

Remediation priorities

Our analysis suggests that vulnerability management teams should prioritize actions based on the accessibility of their EPM consoles to untrusted networks. The following steps are recommended:

1. Identify Affected Assets: Locate all instances of Ivanti Endpoint Manager within the environment, including those integrated into cloud services.
2. Apply Vendor Mitigations: Implement the corrective actions specified in the vendor’s security advisory for EPM 2024 and EPM 2022 SU6.
3. Evaluate Cloud Service Guidance: For deployments utilizing cloud services, follow applicable BOD 22-01 guidance to ensure the shared responsibility model is addressed.
4. Decommissioning: If vendor mitigations cannot be applied or are unavailable for a specific legacy version, our analysis suggests discontinuing use of the product to eliminate the exposure path.

How to validate remediation

Verification must go beyond confirming a software version number. To assure that the vulnerability has been mitigated, defenders should focus on the following:

• Configuration Audit: Verify that the specific mitigations outlined in the vendor instructions have been applied and are active in the system configuration.
• Access Validation: Confirm that unauthenticated requests attempting to access files via absolute paths (path traversal attempts) are now blocked or rejected by the application.
• Deployment Confirmation: Ensure that all nodes in a distributed EPM environment have received the update, as a single unpatched node can maintain the exposure for the entire network.

Limits and open questions

It remains unknown whether this vulnerability is currently being leveraged by ransomware campaigns. Furthermore, while vendor mitigations are available, there may be residual risk if the underlying system permissions allow for lateral movement after an initial information leak. Defenders should note that applying a patch or mitigation reduces the likelihood of exploitation but does not guarantee absolute immunity from other traversal-based flaws.

Source and editorial note

CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability · Source date: March 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 22, 2026 at 00:49 UTC.

Request a Vulnerability Assessment