Is CVE-2024-13159 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal) being exploited in the wild?

What “being exploited in the wild” means for this CVE

For a vulnerability like CVE-2024-13159, “in the wild” means more than theoretical exploitability. It means defenders should treat the issue as an active exposure requiring validation, containment, and prioritised remediation. CISA’s KEV inclusion is the strongest practical signal that exploitation is no longer just a possibility, even when the exploit path is a simple web request rather than a sophisticated chain.

Because the flaw is an absolute path traversal in Ivanti Endpoint Manager, the operational question is whether an attacker can reach the vulnerable endpoint and read information that should have stayed server-side. That makes exposure checks and asset inventory more important than debating exploit complexity: if the product is reachable and unpatched, it belongs in the response queue.

How to confirm exposure and narrow the blast radius

Start by identifying every Ivanti Endpoint Manager instance, including instances that are externally reachable, segmented behind VPN, or exposed only to internal users. Confirm which environments contain the vulnerable product, then determine whether any of them can be reached by unauthenticated network traffic. If the server is internet-facing, assume the investigation must be urgent.

Next, validate whether the exposed instance could leak sensitive information that matters to your environment, such as configuration data, credentials, service details, or internal paths. For this type of flaw, the most useful question is not only “is the system vulnerable?” but “what could an attacker read before we got there?” That distinction determines whether the incident is a simple patching event or a broader compromise assessment.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation timing and tracking, and use the NIST National Vulnerability Database for the canonical vulnerability record and product context. When a KEV-listed issue is present, the remediation decision should be based on exposure and exploitation status, not on whether the vulnerability is already widely discussed elsewhere.

What to do if patching is delayed or you suspect prior access

If you cannot patch immediately, reduce exposure by restricting network reachability to the minimum set of administrative sources, monitoring the endpoint for unusual file access or traversal patterns, and preserving logs before they roll over. For a vulnerability that can leak sensitive information, log retention matters because the useful evidence may be indirect: unusual requests, unexpected reads, or access from hosts that do not normally administer the platform.

If there is any indication of prior exploitation, treat the event as a potential information-disclosure incident and look for follow-on access. Information leaks often become credential recovery, session abuse, or lateral movement problems after the first read succeeds. That is why the response should include credential review for any secrets, tokens, or service accounts the system may have exposed, alongside compromise hunting on adjacent systems.

For response sequencing, the Zero-Day and Exploited Vulnerabilities Guide is useful for triage discipline, while the Vulnerability Management Guide frames the right prioritisation, exceptions, and verification steps once an item lands in the exploited category. The right workflow here is emergency response first, administrative remediation second, and retrospective tuning after exposure is controlled.

Risk and Threat Considerations

Absolute path traversal is dangerous because it can turn a simple request into unintended file disclosure, and disclosure is often the first step in a broader compromise. When the vulnerable service is exposed and unauthenticated, attackers do not need prior access, which lowers the barrier to opportunistic exploitation and increases the chance of automated scanning activity.

Failure mechanism: The application accepts user-controlled path input and resolves it outside the intended directory boundary, allowing retrieval of files that should not be accessible through the product interface.

Impact: Sensitive internal files, configuration material, or secrets can be exposed, and that exposure can enable credential theft, further intrusion, or more targeted attacks against connected systems.

Practitioner Guidance

What to verify: Confirm whether any Ivanti EPM deployment is reachable by untrusted users or exposed through perimeter exceptions, then verify whether logs show repeated probing of path-handling endpoints. If the system stores or references credentials, keys, or internal configuration files in locations reachable through traversal, prioritise those instances first.

Escalation / exception: If you cannot immediately remove exposure, treat the instance as a high-priority exception only when network isolation and compensating monitoring are in place. If there is evidence of successful traversal, escalate beyond patching to compromise assessment and secret rotation.

Practitioner takeaway: For a KEV-listed traversal flaw, the key decision is not whether exploitation is possible, but whether the exposed instance could have leaked something that changes your trust assumptions, because that determines whether patching alone is enough.

Related resources from NHI Mgmt Group

• CVE-2024-13159 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
• CVE-2024-13161 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
• CVE-2024-13160 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
• Is CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass) being exploited in the wild?