CVE-2024-13172 HIGH

CVE-2024-13172

Weakness CWE-347

Published January 14, 2025

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.

Key dates

02Disclosure timeline

January 14, 2025 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-13172 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/347.html

Related vulnerabilities

04Related CVE

CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification CVE-2026-44748 XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform CVE-2026-44309 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2026-13743 Improper verification of cryptographic signature in CubeSpace CW0057 Reaction Wheel CVE-2026-41005 UAA accepts SAML Encrypted Assertions authentication bypass