InfoSecBulletin Cybersecurity for mankind
CISA included three vulnerabilities in Ivanti Endpoint Manager—CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161—in its Known Exploited Vulnerabilities catalog.
Federal agencies must address these vulnerabilities by March 31, 2025, according to CISA’s directive, although no direct ransomware connection has been established.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CISA updated its KEV catalog on March 10, 2025, adding three new vulnerabilities found in Ivanti Endpoint Manager, a popular enterprise software for managing endpoints.
The KEV catalog tracks actively exploited vulnerabilities, encouraging organizations to prioritize fixes to protect critical systems.
The vulnerabilities CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161 are all path traversal issues
Each flaw allows an attacker to access sensitive files by changing file paths, which could expose important information like configuration data or credentials.
Action Required:
Organizations must follow Ivanti’s guidelines, comply with BOD 22-01 for cloud services, or stop using the service if patches are not available.
Deadline: Federal agencies must fix these vulnerabilities by March 31, 2025.
Date Added: They were all added to the KEV catalog on March 10, 2025, due to new evidence of exploitation.
Recommendations:
Monitor Ivanti’s support portal for updates. Limit unauthorized access to EPM instances using firewalls or VPNs. Review file access logs for path traversal attempts. The inclusion of CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161 in CISA’s KEV catalog highlights the increasing risks to endpoint management systems.
Federal agencies have a three-week window to address issues. Enterprises using Ivanti EPM should quickly reduce risks and prevent data leaks from becoming major breaches.
