Ivanti Endpoint Manager Absolute Path Traversal Vulnerability

Historical catalog analysis: CISA added this entry on March 10, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-13161 is an absolute path traversal vulnerability (CWE-36) affecting Ivanti Endpoint Manager (EPM). This flaw allows a remote, unauthenticated attacker to access and leak sensitive information from the system. On March 10, 2025, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating that it has been observed in active exploitation.

Exposure and applicability

Ivanti EPM is utilized for enterprise-wide endpoint management. In healthcare environments, these endpoints often include workstations, servers, and devices that process or store electronic Protected Health Information (ePHI). Because the vulnerability allows an unauthenticated attacker to leak sensitive information remotely, it poses a risk to the confidentiality of patient data and the overall integrity of the healthcare network’s administrative infrastructure.

Remediation priorities

Based on our analysis, healthcare security leaders should prioritize the following actions to reduce exposure:

1. Vendor Mitigation Deployment: The primary priority is to apply the mitigations provided by Ivanti. This is a preventative control intended to block the initial access path used for the path traversal.
2. Cloud Service Review: For organizations utilizing cloud-based deployments of EPM, we recommend reviewing configurations in alignment with BOD 22-01 guidance to ensure that cloud-specific exposure is minimized.
3. Inventory Assessment: Clinical engineering and IT teams should identify all instances of Ivanti EPM across the environment to ensure no legacy or shadow installations remain unpatched.
4. Decommissioning Evaluation: In scenarios where mitigations cannot be applied or are unavailable for a specific version, we suggest evaluating whether to discontinue use of the product to eliminate the risk entirely.

How to validate remediation

To verify that exposure has been reduced, administrators should employ the following methods:

• Version Verification: Confirm that the installed version of Ivanti EPM matches the patched or mitigated versions specified in the vendor’s security advisory.
• Configuration Audit: Review system logs and configuration files to ensure that the specific mitigations recommended by the vendor are active and functioning as intended.
• Authorized Testing: In coordination with clinical engineering, perform safe, authorized connectivity tests to verify that unauthorized remote requests to sensitive paths are being blocked. This should be done in a non-production environment first to avoid disrupting patient care operations.

Limits and open questions

While applying vendor mitigations could reduce the likelihood of exploitation, it does not guarantee complete prevention against all future variants of path traversal attacks. It remains unknown whether this vulnerability has been utilized specifically in ransomware campaigns. Additionally, while CISA has established a remediation deadline for federal agencies, private healthcare providers must determine their own patching timelines based on their internal risk management frameworks and the criticality of the affected systems.

Source and editorial note

CVE-2024-13161: Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability · Source date: March 10, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 13, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 19, 2026 at 00:46 UTC.

Request a healthcare security assessment