Ivanti Endpoint Manager Absolute Path Traversal (CVE-2024-13161)

Historical catalog analysis: CISA added this entry on March 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-13161 is an absolute path traversal vulnerability (CWE-36) identified in Ivanti Endpoint Manager (EPM). This flaw allows a remote, unauthenticated attacker to access and leak sensitive information from the affected system. By bypassing intended directory restrictions, an attacker could potentially retrieve files that should not be accessible via the network.

Exposure and applicability

This vulnerability affects organizations deploying Ivanti Endpoint Manager. Because the exploit path does not require authentication, any instance of EPM exposed to a network—whether internally or externally—is a potential target. The primary risk is the unauthorized disclosure of sensitive data, which could be used to facilitate further attacks or compromise organizational confidentiality.

Remediation priorities

Based on the available data, vulnerability management teams should prioritize the following actions:

1. Asset Identification: Locate all active deployments of Ivanti EPM within the environment to determine the total attack surface.
2. Vendor Mitigation Application: Apply the specific mitigations provided by Ivanti. For those utilizing cloud services, adherence to BOD 22-01 guidance is recommended where applicable.
3. Decommissioning Evaluation: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific version, the source suggests discontinuing use of the product to eliminate the exposure.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not always guarantee that the vulnerability is neutralized in a specific environment. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation State: Verify through configuration audits that the vendor-specified mitigations are active and correctly configured.
• Test Access Controls: Use authorized security testing to attempt path traversal requests against the EPM interface to confirm that sensitive files are no longer accessible via unauthenticated remote requests.
• Log Analysis: Review system logs for evidence of previous absolute path traversal attempts, which may indicate whether the vulnerability was targeted prior to remediation.

Limits and open questions

There is currently no confirmed data regarding whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has established a remediation deadline for federal agencies (2025-03-31), this date does not automatically apply to private sector organizations, though it serves as a benchmark for urgency. Residual risk remains if mitigations are applied inconsistently across a distributed environment or if compensating controls fail to block the traversal path.

Source and editorial note

CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability · Source date: March 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 22, 2026 at 00:54 UTC.

Request a Vulnerability Assessment