CVE-2024-13161: Ivanti Endpoint Manager absolute path traversal leaks sensitive files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known exploitation, has a very high EPSS score, and allows unauthenticated remote reading of sensitive data from a management server.

What it is

Ivanti Endpoint Manager (EPM) contains an absolute path traversal flaw (CWE-36) that lets a remote attacker read files outside the intended directory. It affects EPM 2024 before the January-2025 Security Update and EPM 2022 SU6 before the January-2025 Security Update. Because the endpoint management server holds credentials and configuration for managed devices, leaked files can expose high-value data.

Impact

An unauthenticated attacker gains read access to sensitive files on the EPM server, which can include credentials and configuration usable for further intrusion. There is no integrity or availability impact; the loss is confidentiality.

Attack surface

Reachable over the network via crafted path traversal requests to the EPM server; the CVSS vector shows no privileges and no user interaction required. No authentication is needed per the description and vector.

Exploitation

Listed in CISA KEV with a due date of 2025-03-31, indicating known exploitation in the wild, and EPSS is very high at roughly 0.90 (99.8th percentile). A third-party advisory is tagged as an exploit reference.

What to do

• Apply the Ivanti January-2025 Security Update for EPM 2024 or EPM 2022 SU6 as instructed in the vendor advisory.
• If patching cannot be completed by the KEV due date, follow vendor mitigations or discontinue use of the product per BOD 22-01 guidance.
• Restrict network access to the EPM server so only trusted management hosts can reach it.
• Rotate credentials and secrets that may reside on or be managed by the EPM server.
• Monitor vendor and CISA guidance for updated mitigations.

Detection

• Review EPM server and web logs for path traversal patterns such as ../ or encoded variants in request paths.
• Alert on file read requests to paths outside expected EPM directories.
• Hunt for anomalous access to configuration or credential files on the EPM host.
• Correlate EPM server activity with outbound connections or authentication attempts from unexpected sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.