CVE-2024-13159

The vulnerability in Ivanti Endpoint Manager stems from an absolute path traversal flaw, which allows remote unauthenticated attackers to access sensitive information stored on the server. This type of vulnerability occurs when an application does not properly validate user input, enabling an attacker to manipulate file paths. By exploiting this flaw, an attacker can potentially read files outside the intended directory, leading to unauthorized access to sensitive data such as configuration files, user credentials, or other critical information. The issue is particularly concerning as it affects multiple versions of the Endpoint Manager, including those prior to the January 2025 Security Update and several specific updates from 2022.

Attack vectors for this vulnerability are relatively straightforward, as they do not require authentication, making it accessible to a wide range of potential attackers. An attacker could craft a malicious request that includes directory traversal sequences (e.g., "../") to navigate the file system and access files that should be restricted. For instance, by sending a specially crafted HTTP request to the affected application, an attacker could retrieve sensitive files that contain configuration settings or user data. This exploitation could be executed from anywhere on the internet, significantly increasing the risk of data breaches, especially for organizations that may not have robust perimeter defenses in place.

The real-world impact of this vulnerability can be severe, particularly for organizations that rely on Ivanti Endpoint Manager for managing their IT infrastructure. The potential for sensitive data leakage poses significant business risks, including reputational damage, regulatory penalties, and financial losses. If an attacker successfully exploits this vulnerability, they could gain access to critical information that could be used for further attacks, such as identity theft or corporate espionage. Additionally, the exposure of sensitive data could lead to compliance violations, especially for organizations subject to regulations such as GDPR or HIPAA, which mandate strict data protection measures.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating the Endpoint Manager to the latest versions provided by Ivanti is crucial, as these updates often include patches for known vulnerabilities. Furthermore, employing web application firewalls (WAF) can help filter out malicious requests that attempt to exploit path traversal vulnerabilities. Organizations should also conduct regular security assessments and penetration testing to identify potential weaknesses in their systems. Additionally, implementing strict access controls and monitoring for unusual access patterns can help detect and respond to exploitation attempts in real-time.

In conclusion, the absolute path traversal vulnerability in Ivanti Endpoint Manager presents a significant risk to organizations that utilize this software for endpoint management. The ease of exploitation combined with the potential for severe consequences necessitates immediate attention from affected entities. By prioritizing timely updates, employing security best practices, and fostering a culture of security awareness, organizations can better protect themselves against the threats posed by this and similar vulnerabilities.

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2024-13159, indicating increased exploitation attempts targeting Ivanti Endpoint Manager. This uptick, while still emerging, signals growing adversary interest and potential reconnaissance or initial access operations leveraging the absolute path traversal vulnerability. The appearance of new proof-of-concept exploits circulating publicly further lowers the barrier for threat actors to weaponize this flaw, amplifying the risk to affected environments. Although ransomware involvement remains unconfirmed, the heightened activity underscores the vulnerability’s attractiveness as a vector for sensitive information disclosure, which could facilitate subsequent intrusion stages. Consequently, the threat level associated with CVE-2024-13159 has intensified from a latent concern to an active exploitation phase, warranting elevated vigilance from defenders monitoring endpoint management infrastructure.

Update 2 — May 20, 2026

CSURFACE threat intelligence has identified a critical reassessment of CVE-2024-13159’s severity, with the CVSS score elevated from 7.5 to 9.8, reflecting a more accurate depiction of its exploitability and impact. This adjustment coincides with the vulnerability’s recent inclusion in the Known Exploited Vulnerabilities (KEV) catalog, signaling recognition by authoritative bodies of its active threat status. Although telemetry indicates a significant reduction in detection activity, the emergence of a ransomware group association—previously unreported—marks a concerning development, suggesting that adversaries are increasingly integrating this flaw into their operational toolkits. The slight decline in the Exploit Prediction Scoring System (EPSS) score does not diminish the heightened criticality but rather underscores a transient lull in exploitation attempts, which may precede renewed offensive campaigns. The availability of public proof-of-concept exploits continues to lower barriers for threat actors, amplifying the risk of sensitive information disclosure and potential lateral movement within compromised networks. For defenders, these changes necessitate recalibrated risk assessments, as the vulnerability now presents a more imminent and severe threat vector, particularly given its ransomware linkage and formal KEV listing. Consequently, CVE-2024-13159’s threat level has escalated from a latent vulnerability to a critical priority requiring sustained monitoring and response readiness.

Update 3 — June 07, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2024-13159, with telemetry indicating a doubling in observed exploitation attempts. This increase coincides with the recent inclusion of this vulnerability in the KEV catalog, underscoring its growing prominence in the threat landscape. Although the EPSS score remains high and stable, the slight upward adjustment reflects a subtle intensification in exploitation potential. Notably, no confirmed ransomware campaigns have been linked to this vulnerability to date, and associated threat actor activity remains limited. However, the availability of public proof-of-concept exploits continues to lower the barrier for adversaries, amplifying the risk of sensitive data exposure through remote, unauthenticated access. For defenders, this evolving pattern signals a transition from theoretical risk to active exploitation attempts, necessitating heightened vigilance. Consequently, the threat level for CVE-2024-13159 has shifted toward a more immediate concern, reinforcing its status as a critical priority within endpoint security frameworks.

Update 4 — June 15, 2026

The recent adjustment of CVE-2024-13159’s CVSS score from 9.8 to 7.5 reflects a refined understanding of its exploitability and impact, aligning with updated vulnerability assessments and patch availability. Despite the lowered severity rating, the EPSS score’s increase to nearly 1.0 indicates an elevated likelihood of exploitation in the wild, corroborated by a slight upward trend in exploit attempts detected by our telemetry. The inclusion of this vulnerability in the KEV catalog underscores its recognized importance within the security community, although no confirmed ransomware campaigns or high-confidence threat actor associations have emerged to date. The availability of public proof-of-concept exploits continues to facilitate adversary engagement, sustaining pressure on defenders to monitor for unauthorized access attempts. Consequently, while the immediate criticality has been moderated, the persistent exploitation potential and active interest from the attacker community maintain CVE-2024-13159 as a significant threat requiring ongoing vigilance.

Update 5 — June 22, 2026

CSURFACE threat intelligence has identified a notable increase in detection activity related to CVE-2024-13159, reflecting a subtle but meaningful escalation in adversary engagement targeting Ivanti Endpoint Manager. This upward trend in telemetry suggests that threat actors are intensifying reconnaissance or exploitation attempts, likely leveraging the publicly available proof-of-concept exploit to probe vulnerable environments. Although ransomware groups remain unassociated with this vulnerability, the growing frequency of exploitation attempts elevates the risk of sensitive information disclosure, which could serve as a precursor to more complex attack chains. Consequently, this development underscores the necessity for defenders to maintain heightened monitoring and response capabilities. While the overall threat level remains high due to the vulnerability’s inherent severity and exploitability, the recent surge in activity signals an increased immediacy in potential impact, warranting sustained vigilance.

Update 6 — July 08, 2026

CSURFACE threat intelligence has detected a slight increase in activity exploiting CVE-2024-13159, reflected by a modest rise in telemetry signals. Although the overall trend remains stable without rapid escalation, this uptick indicates continued adversary interest in leveraging the absolute path traversal vulnerability within Ivanti Endpoint Manager. The persistence of publicly available proof-of-concept exploits likely contributes to sustained probing attempts. While no direct ransomware group associations have emerged, the incremental growth in exploitation attempts heightens the risk of sensitive data leakage, which could facilitate subsequent attack stages. This subtle but consistent increase underscores the need for defenders to maintain vigilant monitoring, as the threat environment remains dynamic. Consequently, the risk level remains elevated, with the evolving activity suggesting a gradual intensification of exploitation efforts rather than an abrupt surge.