Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Ivanti · Endpoint Manager (EPM)
An absolute path traversal flaw in Ivanti Endpoint Manager (EPM) lets a remote attacker reach files outside the intended directory via absolute paths. Exploitation requires no authentication or user interaction over the network, and the attacker can leak sensitive information from the affected EPM installation.
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 55 days after disclosure.
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4Initial AccessTA0001
An attacker can exploit this vulnerability to coerce credential relay attacks and gain access to sensitive information.
Credential AccessTA0006
DiscoveryTA0007
Lateral MovementTA0008
Detection
0 rules for this CVE · 177 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2024-13161 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Steal or Forge Kerberos TicketsT15586 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Mimikatz Kirbi File Creationcriticaltest
- Replay Attack Detectedhightest
- Uncommon Outbound Kerberos Connectionmediumtest
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlockmediumexperimental
- User with Privileges Logonlowtest
Pass the HashT1550.0026 general rules
- Hacktool Rulerhightest
- Successful Overpass the Hash Attempthightest
- Pass the Hash Activity 2mediumstable
- NTLMv1 Logon Between Client and Servermediumtest
- Potential Pass the Hash Activitymediumtest
- NTLM Logonlowtest
Account DiscoveryT108716 general rules
- Chopper Webshell Process Patternhightest
- HackTool - SOAPHound Executionhightest
- HackTool - winPEAS Executionhightest
- Hacktool Rulerhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- Network Reconnaissance Activityhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- 44 more on OTX