CVE-2024-13160: Ivanti Endpoint Manager absolute path traversal information leak

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, listed in CISA KEV as actively exploited, and carries a very high EPSS probability.

What it is

Ivanti Endpoint Manager (EPM) contains an absolute path traversal flaw (CWE-36) that allows a remote, unauthenticated attacker to read files outside the intended directory. It affects EPM before the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. Because it exposes sensitive information without credentials, it is a serious exposure risk for EPM deployments.

Impact

An attacker gains read access to sensitive files on the EPM server, which can include configuration data or credentials useful for follow-on attacks. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality.

Attack surface

Reachable over the network with no authentication and no user interaction required (CVSS AV:N/PR:N/UI:N). Any host that can reach the exposed EPM service can attempt the traversal.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-03-10, indicating active exploitation, and EPSS shows a 30-day probability of 0.91247 (99.8th percentile). A third-party advisory is tagged as an exploit reference.

What to do

• Apply the Ivanti EPM 2024 January-2025 Security Update or the 2022 SU6 January-2025 Security Update as directed by the vendor advisory.
• If patching cannot be completed by the CISA due date (2025-03-31), apply vendor-provided mitigations or discontinue use of the product per BOD 22-01 guidance.
• Restrict network access to the EPM management interface to trusted administrative networks and block it from untrusted or internet-facing exposure.
• Rotate credentials and secrets that may have been stored on or accessible from the EPM server.
• Monitor vendor and CISA guidance for updated mitigation instructions.

Detection

• Review EPM server and web logs for path traversal patterns such as ../ or encoded variants in request paths.
• Alert on unexpected outbound or file-read activity from the EPM service account targeting configuration or credential files.
• Hunt for access to EPM endpoints from hosts outside the expected administrative network range.
• Correlate EPM server file access events with external connection sources around the time of suspected exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.