How do you patch or mitigate CVE-2024-13161 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)?

CISA’s required action for CVE-2024-13161 is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Endpoint Manager (EPM) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

How to confirm exposure to CVE-2024-13161 across the estate

Start by finding every Ivanti Endpoint Manager (EPM) instance, because mitigation only works if you know where the product is deployed and whether any instance is internet-facing. For this kind of path traversal issue, the practical question is not just “is it installed?”, but also which servers are reachable, which users depend on them, and whether the vulnerable component is exposed through a perimeter service or management interface.

Once the estate is mapped, validate the product is actually the affected Ivanti Endpoint Manager deployment and not a similarly named system, then check whether each instance can receive the vendor’s security update or documented mitigation. If you cannot confirm a clean inventory, treat that as a risk signal, because hidden management servers are often the ones that stay exposed longest.

When exposure is unclear, compare network reachability, asset ownership, and software inventory together. For path traversal vulnerabilities, a server that is not obviously public can still be reachable through internal trust paths, remote administration channels, or cloud-connected services, so the safest assumption is to verify every instance directly rather than rely on generic segmentation assumptions.

Patch, mitigate, or remove internet exposure

CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The operational decision is therefore simple: patch or mitigate first, but if you cannot do that safely, reduce exposure immediately by removing internet access or taking the product out of service. See the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details.

In practice, a documented mitigation is only useful if it actually blocks the traversal path and can be kept in place under normal operations. If the vendor’s guidance requires temporary controls, enforce them as a real change, not as an informal exception, and confirm that the control survives restarts, maintenance windows, and routine administration. For product teams, the most common failure is assuming that a partial mitigation is equivalent to a fix when the vulnerable path still exists.

If patching must wait, remove the reachable attack surface before doing anything else. That usually means disabling external access, limiting the management plane to trusted networks, or moving the service behind stronger access controls while you schedule the update. The right measure is whether an unauthenticated remote requester can still reach the vulnerable endpoint, not whether the server is theoretically “protected” by policy on paper.

Check for earlier compromise before and after remediation

Because this vulnerability was placed in CISA’s KEV catalogue, remediation should be paired with a compromise review, not treated as a routine maintenance task. Path traversal can expose files, configuration material, or application data, so you should review logs, file access patterns, unusual requests, and any signs that the system was used as an entry point or data source before the fix was applied.

Look for indicators that the server behaved differently before remediation, such as unexpected requests to administrative or file-handling paths, changes to local configuration, or evidence that an attacker reached beyond the intended application boundary. If the vulnerable system stores credentials, tokens, or other operational secrets, rotate the exposed material where there is any realistic chance it was accessed.

After mitigation or patching, verify the server is no longer reachable through the vulnerable path and that the fix did not break normal management workflows. Post-remediation validation matters because a failed patch, a reverted configuration, or a missed second instance can leave the same exposure in place even after the change is marked complete.

Risk and Threat Considerations

Absolute path traversal in a management product can be high impact because the reachable file boundary may let an attacker read sensitive content that was never meant to be exposed. In a tool like Ivanti Endpoint Manager, that can mean configuration data, operational metadata, or other material that helps an attacker deepen access or move laterally once the first foothold is gained.

Failure mechanism: The attacker supplies a path that escapes the intended directory handling logic and forces the application to return or process files outside the approved scope. If the product is internet-facing, that failure becomes exploitable without internal access, which is why removal of exposure is a valid emergency control when a fix cannot be applied.

Impact: The likely consequences are unauthorized file disclosure, exposure of sensitive configuration, and secondary compromise if the leaked material supports authentication, administration, or follow-on access. In a management platform, even a narrow file read can create a broad operational blast radius because the application often sits close to the systems it manages.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE patching and exposure reduction are core vulnerability management tasks.
Recommendation — Prioritise and remediate the Ivanti exposure through continuous vulnerability management.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The subject is patching and mitigating a known exploited vulnerability.
Recommendation — Track, prioritise, and remediate the vulnerable Ivanti instances through a formal vulnerability process.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Applying vendor fixes or mitigations for a known flaw directly maps to remediation control.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming where EPM is deployed and exposed requires vulnerability discovery and validation.
	AC-4 — Information Flow Enforcement	Removing internet exposure or limiting reachability is an information flow control response.
Recommendation — Apply the vendor fix or approved mitigation and verify the remediation on every instance. Scan and validate every Ivanti Endpoint Manager instance before and after remediation. Restrict access paths so untrusted networks cannot reach the vulnerable service.

Practitioner Guidance

What to prioritise: Treat inventory, exposure reduction, and verified remediation as one sequence. The first decision is whether any Ivanti Endpoint Manager instance is internet-facing or otherwise reachable from untrusted networks; if yes, prioritise that instance first.

What to verify: Confirm the vendor mitigation really removes the traversal path, not just the obvious request pattern. Then verify the fix on every deployed instance, because “we patched one server” is not a meaningful outcome when multiple management nodes or environments exist.

Decision rule: If you cannot apply the vendor update or mitigation in a timely way, take the product out of service or remove internet exposure immediately. If the system must stay online, document the exception, define the compensating control, and schedule a short-fuse remediation window.

Practitioner takeaway: For a KEV-listed management flaw, the real control is verified elimination of reachable exposure, not a hope that the vulnerable service will stay undiscovered.