Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-13159

CVE-2024-13159CRITICAL

Ivanti Endpoint Manager (EPM)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS    %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9999   100.0   YES

AFFECTED
  Product           Versions     Fixed
  Endpoint Manager  unspecified  2024 January-2025 Security Update

TIMELINE
  Jan 7   Reserved by ivanti
  Jan 14  Published (CNA: ivanti)
  Mar 10  Added to CISA KEV, remediation due 2025-03-31

CWE-36 · CNA: ivanti · CVSS v3.1 · 3 references · KEV due March 31, 2025

Description

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 7, 2025	Reserved	Reserved by ivanti
January 14, 2025	Published	Published (CNA: ivanti)
March 10, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-03-31

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Ivanti	Endpoint Manager	—	—	2024 January-2025 Security Update

Weaknesses

CWE-36

References (3)

Authoritative record: CVE-2024-13159 at cve.org

Vendors: ivanti

Weaknesses: CWE-36

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-13159 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.