CVE-2024-13159
IV
Ivanti Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
What it is
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-S
- nvd.nist.gov/vuln/detail/CVE-2024-13159
Description and required action as published by CISA. Full record at NVD.
Other Ivanti entries on the list
- Connect Secure Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability CVE-2026-118527 · Oct 30, 2026
- Connect Secure Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-111357 · Oct 30, 2026
- Connect Secure Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CVE-2026-104935 · Oct 13, 2026
- Sentry Ivanti Sentry OS Command Injection Vulnerability CVE-2026-10520 · Jun 11, 2026
- Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability CVE-2026-6973 · May 7, 2026
- Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability CVE-2026-1340 · Apr 8, 2026