CISA's required action for CVE-2024-13160 is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Endpoint Manager (EPM) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.
What the fix path means for an Ivanti EPM path traversal
For a path traversal issue like CVE-2024-13160, the practical question is not only whether a patch exists, but whether you can eliminate the unsafe file access path across every deployed instance. That starts with inventory, because remediation only works if you can confirm which Ivanti Endpoint Manager (EPM) servers are actually exposed and whether each one is still receiving traffic that could reach the vulnerable component.
Path traversal defects are often used to read files outside the intended directory, which can expose configuration data, authentication material, or internal application state. Treat the vendor fix as the preferred outcome, but treat exposure reduction as part of the same workstream when immediate patching is not possible.
For background on how traversal and related web application flaws are typically abused, see the Web Application Attacks Guide. For the broader vulnerability workflow that should frame your response, the Vulnerability Management Guide is the right operating model.
When mitigation is enough, and when removal is safer
The direct answer from CISA is a good decision rule: apply vendor mitigations, follow the applicable cloud guidance, or discontinue use if mitigations are unavailable. In practice, that means you should verify whether the instance can be brought into a supported, vendor-remediated state without weakening business functions or leaving the product internet-facing.
If the affected EPM deployment cannot be patched promptly and the vendor mitigation does not fully remove exposure, reducing reachability is the safer interim control. That can mean removing public access, restricting administrative interfaces to trusted management networks, or decommissioning the product entirely if it cannot be operated safely within your risk tolerance.
Use the vendor advisory for exact configuration steps and validate your exposure against the CISA Known Exploited Vulnerabilities Catalog. For patch verification and asset scoping, cross-check against the NIST National Vulnerability Database and your internal asset inventory, rather than assuming a single deployment location captures every instance.
How to check for compromise before and after remediation
Path traversal is often an exposure issue first and a compromise issue second, but you should not assume there was no exploitation just because a scanner only shows the vulnerability. Review logs for abnormal file access, unexpected requests to application endpoints, new or altered configuration files, and any sign that the product disclosed secrets or internal data that could enable follow-on access.
Where the exposed files could include credentials, certificates, tokens, or service account material, treat those as potentially compromised until proven otherwise. That may require rotating secrets, invalidating sessions, and reviewing any dependent systems that trust the affected EPM instance. If the product touched privileged operations, also assess whether an attacker could have used the exposure as a pivot into broader administrative access.
The best public references for validation are the CVE Program entry for the identifier itself and the CISA catalogue entry for the response obligation. For exploitation context and prioritisation, CISA’s catalogue should remain the operational trigger, not a substitute for local log review and incident triage.
Risk and Threat Considerations
A path traversal flaw in management software matters because it can turn ordinary application access into unintended file exposure. In an EPM product, that can reveal internal paths, configuration details, or sensitive material that lowers the cost of later exploitation, especially if the system is reachable from untrusted networks.
Failure mechanism: The application accepts or resolves a user-controlled path in a way that allows access outside the intended directory boundary, so the attacker can read or influence files the product should never expose.
Impact: Exposed files can disclose secrets, enable lateral access, or reveal enough internal detail to support deeper compromise of the management platform and systems it administers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | Asset discovery is essential to find every EPM instance needing remediation. |
| PR.PS-01 — Configuration Management | Mitigation depends on secure configuration and vendor-directed changes to reduce traversal exposure. | |
| RS.MI-01 — Incidents are Contained | If compromise is suspected, containment limits further exposure from the vulnerable product. | |
| Recommendation — Inventory all EPM instances before deciding patch, isolate, or retire. Apply the vendor mitigation and verify the configuration blocks traversal access. Contain the exposed EPM instance and restrict reachable interfaces until risk is closed. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The issue requires identifying affected instances and tracking remediation status. |
| SI-2 — Flaw Remediation | The core action is applying the vendor fix or approved mitigation for the flaw. | |
| AC-4 — Information Flow Enforcement | Restricting exposure to the management interface helps prevent unintended file access paths. | |
| Recommendation — Scan for every affected EPM deployment and track remediation to closure. Apply the vendor fix or approved mitigation for the traversal vulnerability. Restrict access paths to the affected service until exposure is removed. | ||
Practitioner Guidance
What to prioritise: Confirm every Ivanti EPM instance in scope, then decide whether vendor mitigation, network restriction, or retirement is the fastest safe path to remove exposure. If the system is internet-facing, prioritise that instance first because it carries the highest probability of abuse.
What to verify: Validate that the applied mitigation actually blocks traversal-style requests and that no alternate path, proxy route, or management interface still exposes the affected component. If the product handled credentials or secrets, verify rotation and reauthentication as part of closure, not as an optional follow-up.
Practitioner takeaway: For management-plane vulnerabilities, successful remediation is measured by exposure removed and trust re-established, not by whether a patch was merely installed.
Related resources from NHI Mgmt Group
- CVE-2024-13160 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
- CVE-2024-13161 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
- CVE-2024-13159 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)
- How do you patch or mitigate CVE-2026-1340 (Ivanti Endpoint Manager Mobile (EPMM) Code Injection)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org