Ivanti Endpoint Manager Absolute Path Traversal Vulnerability

Historical catalog analysis: CISA added this entry on March 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-13160 is an absolute path traversal vulnerability (CWE-36) affecting Ivanti Endpoint Manager (EPM). This flaw allows a remote, unauthenticated attacker to access and leak sensitive information from the system. On March 10, 2025, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating that the flaw has been observed in active exploitation.

Exposure and applicability

Ivanti EPM is frequently utilized by healthcare organizations to manage a wide array of endpoints, including clinical workstations, administrative laptops, and servers. Because this vulnerability allows unauthenticated remote access to sensitive data, it poses a risk to the confidentiality of systems that may process or store electronic Protected Health Information (ePHI).

Healthcare security leaders and clinical engineering teams should determine if Ivanti EPM is deployed within their environment and identify which versions are currently in use. The applicability of this vulnerability extends to any instance of the product where the vendor-provided mitigations have not yet been applied.

Remediation priorities

Based on our analysis, healthcare providers and business associates should prioritize the following actions to reduce the likelihood of information leakage:

1. Apply Vendor Mitigations: The primary priority is to implement the specific mitigations provided by Ivanti for EPM 2024 and EPM 2022 SU6. This action is intended to prevent initial unauthorized access to sensitive files.
2. Review Cloud Service Configurations: For organizations utilizing cloud-based deployments, we recommend following guidance consistent with BOD 22-01 to ensure the environment is hardened against remote exploitation.
3. Evaluate Product Viability: In scenarios where mitigations cannot be applied or are unavailable for a specific legacy configuration, organizations should evaluate whether to discontinue use of the product to eliminate the risk entirely.

How to validate remediation

To verify that exposure has been reduced, IT administrators and security teams can perform the following checks:

• Version and Patch Verification: Confirm through the management console or system registries that the specific vendor-recommended updates or mitigation scripts have been successfully applied to all EPM core servers.
• Configuration Audit: Review current access control lists (ACLs) and network segmentation rules to ensure that the EPM management interface is not unnecessarily exposed to the public internet, which could limit the reach of a remote unauthenticated attacker.

Note: Version checks alone do not guarantee security; they only confirm that a specific update was installed.

Limits and open questions

While CISA has confirmed active exploitation, it remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, the source does not specify exactly which types of “sensitive information” are most susceptible to leakage via this path traversal flaw.

Organizations should be aware that applying mitigations could reduce the likelihood of an attack but may not eliminate all residual risks associated with endpoint management software. Coordination with clinical engineering is advised when updating systems that interface directly with medical devices to ensure patient care continuity is not disrupted.

Source and editorial note

CVE-2024-13160: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability · Source date: March 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 19, 2026 at 00:41 UTC.

Request a healthcare security assessment