PT-2025-1136 · Ivanti · Ivanti Epm

Zach Hanley · Published 2025-01-13 · Updated 2026-05-02 · CVE-2024-13159

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update

Description The issue is related to absolute path traversal in Ivanti EPM, allowing a remote unauthenticated attacker to leak sensitive information. Attackers could compromise servers via relay attacks. A proof-of-concept (PoC) exploit has been released, and researchers have revealed technical details on credential coercion vulnerabilities. It is estimated that 73 vulnerable targets have been identified.

Recommendations For Ivanti EPM versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update, patch urgently to fix the vulnerability. As a temporary workaround, consider restricting access to sensitive information and disabling any features that may be exploited via relay attacks until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-36

Related Identifiers

BDU:2025-00409

CVE-2024-13159

Affected Products

Ivanti Epm

References · 56

• 🔥 https://horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities · Exploit
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6 · Vendor Advisory
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US · Security Note
• https://bdu.fstec.ru/vul/2025-00409 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13159 · Security Note
• https://github.com/horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities · Note
• https://github.com/horizon3ai/ivanti-epm-coercion-vulnerabilities · Note
• https://t.me/cvenotify/112018 · Telegram Post
• https://twitter.com/lyrie_ai/status/2050623954180575665 · Twitter Post
• https://twitter.com/ScyScan/status/1899220134193193041 · Twitter Post
• https://twitter.com/samilaiho/status/1894334918739538126 · Twitter Post
• https://twitter.com/Steph4369313869/status/1900040946353660183 · Twitter Post
• https://twitter.com/Shift6Security/status/1899853044159857065 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159 · Note