Is CVE-2024-13160 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal) being exploited in the wild?

Yes. CISA added CVE-2024-13160 to its Known Exploited Vulnerabilities catalogue on 10 March 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.

What “being exploited in the wild” means for this CVE

For a vulnerability like CVE-2024-13160, “in the wild” means defenders should treat it as an active exposure problem, not a theoretical finding. The practical question is whether any Ivanti Endpoint Manager instance is reachable, whether the vulnerable path is exposed, and whether untrusted remote access could let an attacker read data they should not be able to touch.

The right first step is to confirm whether Ivanti EPM is present anywhere in the estate, then determine whether internet-facing access, partner access, or internal lateral access could reach the affected interface. For active exploitation questions, inventory matters more than assumptions, because missed instances are the usual reason exploitation continues after public disclosure.

Once exposure is confirmed, treat the issue as a confidentiality event with potential follow-on compromise. The vulnerability is an absolute path traversal issue, so the operational concern is not only the direct data leak, but also whether leaked configuration, tokens, or administrative material could support broader compromise if the exposed files are sensitive enough. See the CISA Known Exploited Vulnerabilities Catalog and the vendor advisory for authoritative remediation details.

What defenders should check before they assume safety

Start by identifying every EPM deployment, including lab, test, forgotten, and externally reachable instances. A vulnerability can remain exploitable even when the product is not intentionally exposed, if it is reachable through a reverse proxy, VPN path, or internal trust boundary that an attacker has already crossed. The most common failure is believing “internal-only” means “low risk.”

Next, review whether the EPM environment stores credentials, configuration backups, logs, certificates, or other secret material in locations that a path traversal bug could reveal. If the application can expose files that support authentication, remote administration, or downstream integrations, the issue becomes more than a simple information leak. That is why teams should validate both reachability and the sensitivity of what sits behind the vulnerable path.

Use the vendor advisory and the KEV record to confirm the exact product scope and required response. Do not rely on general CVE aggregators alone for operational decisions. The high-value check is whether the vulnerable service is still running, whether it is internet-accessible, and whether any compensating controls actually block the traversal path under real request patterns.

How to respond when patching is delayed

If immediate remediation is not possible, reduce exposure first, then monitor aggressively. Restrict network access to the smallest feasible set of admin hosts or management subnets, disable unnecessary remote paths, and watch for unusual file access patterns, error spikes, or requests that reference abnormal path elements. For a traversal flaw, the attacker’s goal is often simple data discovery before a larger intrusion attempt.

If you have reason to believe the vulnerable service was exposed before remediation, look for earlier compromise rather than waiting for a second sign. Review logs for unexpected downloads, repeated failed reads, administrative anomalies, or access to files that would not normally be requested. If the exposed material could include secrets or administrative credentials, rotate anything that may have been readable, even if you do not yet have proof of theft.

Where compensating controls are temporary, make them explicit and time bound. An access restriction, WAF rule, or network filter is only useful if it is verified against the actual exploit path and removed only after the product is fixed or isolated. A temporary control that nobody validates can create false confidence while the service remains exposed.

Risk and Threat Considerations

The main risk is not just information disclosure, but what that disclosure enables next. A remote unauthenticated attacker who can read sensitive files may recover configuration details, credentials, service endpoints, or other material that helps them move from a single exposed application into broader environment access.

Failure mechanism: Absolute path traversal lets the attacker manipulate file paths so the application returns data outside the intended directory boundary. If the exposed service processes those requests before access controls or file-scope restrictions intervene, sensitive files can be leaked without authentication.

Impact: Even a “read-only” flaw can become a stepping stone to account compromise, lateral movement, or administrative abuse if the leaked material includes secrets, trust material, or operational configuration that supports other systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid identification and remediation of vulnerable EPM instances material.
Recommendation — Prioritize and remediate exposed EPM instances under continuous vulnerability management.
NIST CSF 2.0	PR.PS-01 — Configuration Management	Mitigation depends on controlling exposed services and reducing attack surface around the vulnerable system.
	DE.CM-08 — Vulnerability Scans and Penetration Tests	You need validation that the vulnerable product is still present and reachable in the environment.
Recommendation — Harden the EPM deployment and remove unnecessary exposure paths. Verify exposure with scanning and targeted testing before assuming the service is safe.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	CVE-2024-13160 requires confirmation of exposure and tracking of remediation progress.
	SI-2 — Flaw Remediation	The question is about an actively exploited flaw that requires timely corrective action.
Recommendation — Scan for vulnerable EPM instances and track remediation to closure. Apply the vendor fix or approved mitigation without delay.

Practitioner Guidance

What to prioritise: Confirm exposure first, then determine whether the vulnerable instance can reveal anything that changes access or trust, such as credentials, tokens, certificates, or management data. If it can, treat the issue as a potential compromise-enabler, not a narrow application bug.

What to verify: Prove that the vulnerable request pattern is blocked after any mitigation, and confirm that logging still captures attempted traversal. If you cannot show both, you do not yet have a reliable control.

Practitioner takeaway: For an actively exploited traversal CVE, the key decision is whether the leaked data can be weaponised further, because that determines whether you are dealing with a patching task or a wider incident response problem.