CVE-2024-13159Active Exploitation(ivanti / endpoint_manager)

LOWCVSS 7.5 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (3 mentions)

Immediate actions

Prioritize remediation for ivanti endpoint_manager systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

ivanti CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-03-31. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/

Vendor / third-party advisories

https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159

Weakness type (CWE)

CWE-36

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

endpoint_manager

Threat summary

Active exploitation appears in 3 classified signals
3 mentions across 1 observed day

What's happening

Active exploitation reported across 3 signals
3 total mentions across 1 day

Affected systems

Vendors

ivanti

Products

endpoint_manager

2 versions affected across 1 product

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Active Exploitation

266.7%

Exploit

133.3%

Referenced assets1 URL

By indicator

https://research.lyrie.ai/research/active-exploit-cve-2024-13159-endpoint-manager-epm

Full discourse3 posts

Lyrie.ai@lyrie_ai160d
Active Exploitation
Vendor. CISA added CVE-2024-13159 to the Known Exploited Vulnerabilities (KEV) catalog, signaling in-the-wild exploitation and setting a federal remediation due date of
Post summary
CISA identifies CVE-2024-13159 as actively exploited, adding it to the KEV catalog and urging federal remediation.
1000032
152 followersView on X
Lyrie.ai@lyrie_ai160d
Active Exploitation
CVE-2024-13159. What happened CISA added CVE-2024-13159 to the Known Exploited Vulnerabilities (KEV) catalog, signaling in-the-wild exploitation and setting a federal remediation due date of 2025-03-31 CISA KEV.
Post summary
CISA has categorized CVE-2024-13159 as an actively exploited vulnerability, setting a federal remediation deadline of March 31, 2025.
1000042
152 followersView on X
Lyrie.ai@lyrie_ai160d
Exploit
https://research.lyrie.ai/research/active-exploit-cve-2024-13159-endpoint-manager-epm #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The link references a report of an active exploit against CVE‑2024‑13159 in Endpoint Manager EPM; the text confirms claim of in‑the‑wild activity but provides no PoC, exploit code details, patch information, or technical specifics.
0000035
152 followersView on X

CPE platform detail9 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

9 of 9 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ivanti	endpoint_manager	-	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2022	-	-
App	ivanti	endpoint_manager	2024	-	-

Explore more

Back to dashboard ivanti CVEs endpoint_manager vulnerabilities