CVE-2024-13159: Ivanti EPM absolute path traversal leaks sensitive files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score, is remotely exploitable without authentication, and exposes sensitive data from a central management server.

What it is

Ivanti Endpoint Manager (EPM) contains an absolute path traversal flaw (CWE-36) that lets a remote attacker read files outside the intended directory. It affects EPM before the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. Because the endpoint manager holds credentials and configuration for managed devices, leaked files can expose sensitive information at scale.

Impact

An attacker gains read access to sensitive files on the EPM server, which can include configuration and credential material useful for lateral movement or follow-on compromise. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality only.

Attack surface

Reachable over the network with no authentication and no user interaction (CVSS AV:N/AC:L/PR:N/UI:N). Any host that can reach the EPM service can attempt the traversal.

Exploitation

CISA added it to KEV on 2025-03-10 with a remediation due date of 2025-03-31, indicating known exploitation in the wild. EPSS is 0.99992 (99.987th percentile), and a third-party advisory carries an Exploit tag. No ransomware campaign use is documented.

What to do

• Apply the Ivanti EPM 2024 January-2025 Security Update or the 2022 SU6 January-2025 Security Update immediately.
• If patching cannot be completed by the KEV due date, follow vendor mitigations or discontinue use of the product per BOD 22-01 guidance.
• Restrict network access to the EPM management interface to trusted administrative networks and block it from the internet.
• Rotate credentials and secrets that may reside on or be managed by the EPM server, since file contents may have been read.
• Review EPM logs and file access records for traversal attempts against the affected service.

Detection

• Search web/proxy and EPM logs for path traversal patterns such as absolute paths or ../ sequences in requests to the EPM service.
• Alert on unexpected outbound connections or file reads from the EPM server outside normal administrative activity.
• Monitor for access to sensitive files on the EPM host by the EPM service account and correlate with external source IPs.
• Hunt for post-exploitation use of credentials or configuration data obtained from EPM in authentication logs across managed endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.