CVE-2024-13160: Ivanti Endpoint Manager path traversal and credential coercion, unauthenticated
The short version: CVE-2024-13160 is an absolute path-traversal vulnerability in Ivanti Endpoint Manager (EPM) that lets an unauthenticated attacker reach restricted paths and leak sensitive information. Researchers demonstrated abusing it to coerce the EPM machine-account credential over NTLM — a credential that can be relayed to escalate. It's one of a trio (CVE-2024-13159, -13160, -13161) disclosed together, all in CISA's KEV catalog. If you run EPM, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — unauthenticated info disclosure / credential coercion; rises toward Critical where the coerced credential can be relayed |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~91.0% · 99.80th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-03-31 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-36 absolute path traversal → sensitive-information disclosure / NTLM credential coercion |
| Requires authenticated session? | No — pre-authentication |
| Related CVEs | CVE-2024-13159 and CVE-2024-13161 — the same class, disclosed and patched together |
| Affected | Ivanti EPM before the January-2025 Security Update (EPM 2024 and EPM 2022 SU6) |
| Fixed in | EPM 2024 January-2025 Security Update · EPM 2022 SU6 January-2025 Security Update |
What you need to know
CVE-2024-13160 lets an unauthenticated attacker supply an absolute path that the EPM server dereferences, reaching data and functionality it shouldn't expose. Where it gets sharper: security researchers showed the traversal can be pointed at an attacker-controlled UNC path, which coerces the EPM machine account into authenticating outward and leaking its NTLM credential.
- How they find it — internet-wide scanning surfaces exposed Ivanti EPM servers; version fingerprinting flags the vulnerable builds.
- How they use it — an unauthenticated request either reads sensitive data or triggers the machine account to authenticate to an attacker's host, capturing the hash.
- What it leads to — a captured, relayable machine-account credential can be used to escalate against the EPM server itself — and EPM pushes software to every managed endpoint, so that escalation is consequential. This flaw travels with CVE-2024-13159 and CVE-2024-13161, which share the class and the fix.
How serious we see it
Critical — with honest upside toward Critical.
The NVD score is 9.8, and it's an unauthenticated, KEV-listed flaw — so we don't take it lightly. We land our own take at High because the direct, reliable outcome is disclosure and credential coercion rather than immediate code execution. But severity climbs with context: if the coerced machine-account credential can be relayed to a reachable service, the attacker can escalate toward control of the EPM server and the fleet it manages — and at that point it behaves like a Critical. The reassuring part is that a single January-2025 Security Update closes all three related CVEs at once.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Apply the January-2025 Security Update for EPM 2024 or EPM 2022 SU6 — it addresses CVE-2024-13159, -13160, and -13161 together.
- Reduce relay exposure. Enforce SMB signing and restrict outbound authentication so a coerced credential is harder to relay.
- Hunt for compromise. Review EPM logs for unauthenticated access to restricted paths and unexpected outbound authentication from the server.
- Harden exposure. Restrict who can reach the EPM server; keep it off the public internet where possible.
- Confirm your exposure first. Verify whether you run an affected EPM build.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti EPM servers, fingerprints the product and version, and flags exposure tied to KEV-listed vulnerabilities like this trio — surfaced at the top of your results because they're in KEV. This is version-based discovery and flagging; BreachRisk maps the exposed, affected server rather than coercing credentials from it.
That continuous, attacker's-eye view keeps a management server that quietly faces the internet on your radar before it becomes an attacker's pivot point.