CVE-2024-13160

The vulnerability in Ivanti Endpoint Manager is characterized by an absolute path traversal flaw, which allows an unauthenticated remote attacker to access sensitive information stored on the server. This type of vulnerability occurs when an application does not properly sanitize user input, enabling attackers to manipulate file paths. In this case, the flaw permits attackers to traverse the directory structure of the server, potentially exposing files that should remain confidential. The affected versions include multiple releases of the Endpoint Manager, specifically those prior to the January 2024 security update and earlier updates from 2022.

Attack vectors for exploiting this vulnerability are relatively straightforward, as they primarily involve sending crafted requests to the affected application. An attacker could leverage tools to automate the process of sending requests that include directory traversal sequences, such as "../", to navigate the file system. By successfully exploiting this flaw, an attacker could retrieve sensitive files, including configuration files, user credentials, or other critical data that could be used for further attacks. The simplicity of the attack vector increases the likelihood of exploitation, especially in environments where security measures are not rigorously enforced.

The real-world impact of this vulnerability can be significant for organizations using Ivanti Endpoint Manager. The potential for sensitive information leakage poses a serious business risk, as it could lead to unauthorized access to corporate networks, data breaches, and compliance violations. Organizations may face reputational damage, financial losses, and legal repercussions if sensitive data is exposed. Furthermore, the ability to extract sensitive information could facilitate more advanced attacks, such as privilege escalation or lateral movement within the network, compounding the risk associated with this vulnerability.

To detect and mitigate this vulnerability, organizations should implement several strategies. Regular security assessments and vulnerability scans can help identify instances of the flaw within their systems. Additionally, applying the latest security updates provided by Ivanti is crucial to patching the vulnerability and preventing exploitation. Organizations should also consider implementing web application firewalls (WAFs) to filter and monitor incoming traffic for malicious patterns indicative of path traversal attempts. Furthermore, adopting a principle of least privilege for file access can minimize the potential impact of any successful exploitation, ensuring that even if an attacker gains access, the damage is limited.

In conclusion, the absolute path traversal vulnerability in Ivanti Endpoint Manager represents a significant threat to organizations relying on this software for endpoint management. The ease of exploitation, coupled with the potential for severe consequences, underscores the necessity for immediate action. Organizations must prioritize detection and mitigation efforts to safeguard sensitive information and maintain the integrity of their systems. By staying informed about vulnerabilities and implementing robust security practices, businesses can better protect themselves against the evolving landscape of cyber threats.

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2024-13160, indicating increased adversary interest or testing in the wild. Although the overall exploit landscape remains unchanged with no new proof-of-concept exploits or ransomware affiliations reported, the sharp rise in telemetry suggests that threat actors may be actively probing vulnerable Ivanti Endpoint Manager instances more frequently. This uptick in activity elevates the urgency for defenders to maintain vigilant monitoring, as the increased probing could precede more widespread exploitation attempts. While the EPSS score remains high and stable, the surge in observed activity signals a heightened risk environment that could accelerate if exploitation techniques or payloads emerge. Consequently, the threat level associated with this vulnerability should be considered elevated due to the growing adversary engagement detected by our sensors.

Update 2 — May 20, 2026

CSURFACE threat intelligence has identified a critical reassessment of CVE-2024-13160, reflected by an upward revision of its CVSS score from 7.5 to 9.8, underscoring a heightened severity level. This adjustment aligns with the vulnerability’s recent inclusion in the KEV catalog, signaling increased recognition of its potential impact within the security community. Despite a significant reduction in detection activity observed by our sensors, the elevated EPSS score and the appearance of a ransomware group association—previously unreported—indicate that adversaries are increasingly aware of and potentially preparing to leverage this flaw. The ransomware linkage, although currently classified as low confidence, marks a notable shift in the threat landscape, suggesting that exploitation could be weaponized in targeted campaigns. For defenders, this evolving profile demands recalibrated risk assessments that account for the vulnerability’s amplified criticality and emerging adversary interest, even as immediate exploitation attempts appear subdued. Consequently, the overall threat level for CVE-2024-13160 should be considered elevated, reflecting both its intrinsic severity and the strategic value it holds for threat actors.

Update 3 — June 07, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2024-13160, reflecting a growing adversary focus on exploiting the absolute path traversal vulnerability in Ivanti Endpoint Manager. Although the overall exploit landscape remains static with no new public proof-of-concept exploits reported, the sharp increase in telemetry signals a heightened reconnaissance or initial probing phase by threat actors. This uptick, coupled with the vulnerability’s critical severity and its inclusion in the KEV catalog, underscores an elevated risk posture. Defenders should interpret this trend as an early indicator of potential exploitation campaigns, even in the absence of confirmed ransomware group involvement or active weaponization. Consequently, the threat level for CVE-2024-13160 should be considered elevated due to increased attacker interest and activity, warranting closer monitoring and prioritization within vulnerability management workflows.

Update 4 — June 15, 2026

Recent adjustments to the CVSS severity score for CVE-2024-13160 have lowered its rating from critical (9.8) to high (7.5), reflecting a refined understanding of the vulnerability’s exploitability and impact. Concurrently, the Exploit Prediction Scoring System (EPSS) value has slightly decreased, indicating a modest reduction in the likelihood of widespread exploitation in the near term. Despite these downward revisions, the vulnerability remains listed in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its continued relevance in threat landscapes. CSURFACE threat intelligence has not detected any new exploit techniques or active ransomware campaigns leveraging this flaw, and no high-confidence associations with ransomware groups have emerged. This recalibration suggests that while immediate exploitation pressure may be less intense than initially assessed, the vulnerability still poses a significant risk due to its remote unauthenticated attack vector and potential for sensitive information disclosure. Defenders should interpret this update as a signal to maintain prioritized attention within vulnerability management processes, balancing the lowered severity against the persistent presence in KEV and ongoing attacker interest as observed through our telemetry.

Update 5 — June 22, 2026

CSURFACE threat intelligence has identified a slight increase in detection activity related to CVE-2024-13160, indicating a modest resurgence of attacker interest despite a recent downward trend in exploit attempts. This subtle uptick underscores that adversaries continue to probe Ivanti Endpoint Manager environments for this absolute path traversal vulnerability, which remains exploitable without authentication. Although no new exploit techniques or ransomware group associations have been observed, the persistence of this vulnerability in active scanning campaigns highlights its ongoing relevance in the threat landscape. For defenders, this development signals that while immediate exploitation pressure is not intensifying dramatically, the vulnerability’s remote attack vector and potential for sensitive data leakage sustain its high-risk profile. Consequently, organizations should maintain vigilant monitoring and prioritize remediation efforts accordingly, as the vulnerability continues to attract opportunistic targeting that could facilitate information disclosure or serve as a foothold for further compromise.

Update 6 — July 08, 2026

CSURFACE threat intelligence has detected a slight increase in activity related to CVE-2024-13160, reflecting a modest uptick in attempts to leverage the absolute path traversal vulnerability in Ivanti Endpoint Manager. Although this rise does not indicate a rapid escalation or widespread exploitation, the persistence of targeting underscores the vulnerability’s continued attractiveness to threat actors seeking to exfiltrate sensitive information remotely without authentication. Our telemetry confirms that while no new exploit techniques or ransomware group associations have emerged, the vulnerability remains a viable vector for opportunistic attackers. This subtle increase in detection activity reinforces the need for defenders to sustain vigilance, as the risk of information leakage persists. Consequently, the overall threat level remains high, consistent with the vulnerability’s inherent severity and exploitability profile, but without evidence of accelerated exploitation campaigns or expanded adversary interest.