CVE-2024-13158: RCE in Ivanti Endpoint Manager

Successful exploitation of CVE-2024-13158 grants an attacker complete control over the compromised Ivanti Endpoint Manager server. Given the role of Ivanti Endpoint Manager in managing endpoints, this could lead to widespread compromise across the organization. An attacker could deploy malware, steal sensitive data, or establish a persistent foothold within the network. The ability to execute code remotely, combined with administrative privileges, significantly expands the potential blast radius. This vulnerability shares similarities with other resource exhaustion vulnerabilities where attackers can leverage flawed search paths to gain unauthorized access and control.

1. Reserved2025-01-07
2. Published2025-01-14
3. Modified2026-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-13158 is to upgrade to the 2024 January-2025 Security Update or later. If immediate patching is not feasible, consider restricting administrative access to the Ivanti Endpoint Manager server. Implement strict network segmentation to limit lateral movement if the server is compromised. While a WAF might not directly prevent this vulnerability, it can help detect and block suspicious requests. Monitor Ivanti Endpoint Manager logs for unusual activity, particularly related to resource searches. After upgrading, verify the fix by attempting to reproduce the vulnerability using the documented attack vector and confirming that the search path is now properly bounded.