CVE-2024-13160 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Ivanti EPM suffers from an **Absolute Path Traversal** flaw. 📂 💥 **Consequences**: Remote attackers can **leak sensitive information** without any authentication. Critical data exposure is the main risk.

Q: Who is affected? (Versions/Components)

🏢 **Affected**: **Ivanti Endpoint Manager (EPM)**. 📦 🌍 **Vendor**: Ivanti (USA). 🇺🇸 📅 **Status**: Advisory released Jan 2025 for EPM 2024 & 2022 SU6.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 📉 🔓 **Auth**: **None required** (Unauthenticated). 🚫 🎯 **Complexity**: Low (CVSS AC:L). 🎯 👤 **User Interaction**: None required. 🙅♂️

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: **Yes**. 🧪 📜 **PoC Available**: Public Nuclei template exists on GitHub (projectdiscovery). 🐳 ⚠️ **Risk**: Automated scanning tools can detect and potentially exploit this easily.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Scan for **Ivanti EPM** endpoints. 📡 2. Use **Nuclei** with the specific CVE-2024-13160 template. 🧪 3. Look for improper validation in the **wildcard parameter**. 🔎

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **Yes**. 🛠️ 📢 **Official**: Ivanti released a Security Advisory in Jan 2025. 📅 ✅ **Action**: Apply the official patch/update for EPM 2024/2022.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: 1. **Block** external access to the vulnerable endpoint. 🚫 2. **Restrict** NTLM authentication sources. 🔒 3. Monitor for unusual **UNC path** requests. 📊 4. Isolate the EPM server if possible. 🏝️

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 📈 **Priority**: **P1**. 🔴 💡 **Reason**: Unauthenticated, Low complexity, High impact (CVSS High), and Public PoC exists. Patch immediately! ⏱️

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Ivanti EPM suffers from an **Absolute Path Traversal** flaw. 📂
💥 **Consequences**: Remote attackers can **leak sensitive information** without any authentication. Critical data exposure is the main risk.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-36** (Absolute Path Traversal). 📉
🔍 **Flaw**: Improper input validation in the **wildcard parameter** of the `GetHashForWildcard` endpoint.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Affected**: **Ivanti Endpoint Manager (EPM)**. 📦
🌍 **Vendor**: Ivanti (USA). 🇺🇸
📅 **Status**: Advisory released Jan 2025 for EPM 2024 & 2022 SU6.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: 
**Coerce** the EPM machine account credential. 🔑
Trigger **NTLM authentication** via remote UNC paths. 🌐
…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 📉
🔓 **Auth**: **None required** (Unauthenticated). 🚫
🎯 **Complexity**: Low (CVSS AC:L). 🎯
👤 **User Interaction**: None required. 🙅‍♂️

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploit Status**: **Yes**. 🧪
📜 **PoC Available**: Public Nuclei template exists on GitHub (projectdiscovery). 🐳
⚠️ **Risk**: Automated scanning tools can detect and potentially exploit this easily.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 
Scan for **Ivanti EPM** endpoints. 📡
Use **Nuclei** with the specific CVE-2024-13160 template. 🧪
Look for improper validation in the **wildcard parameter**. 🔎

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **Yes**. 🛠️
📢 **Official**: Ivanti released a Security Advisory in Jan 2025. 📅
✅ **Action**: Apply the official patch/update for EPM 2024/2022.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: 
**Block** external access to the vulnerable endpoint. 🚫
**Restrict** NTLM authentication sources. 🔒
Monitor for unusual **UNC path** requests. 📊
Isolate the EPM server if possible. 🏝️

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨
📈 **Priority**: **P1**. 🔴
💡 **Reason**: Unauthenticated, Low complexity, High impact (CVSS High), and Public PoC exists. Patch immediately! ⏱️

Continue exploring

Vulnerability detail Full AI analysis (login) Ivanti CWE-36