In March 2025, Ivanti disclosed CVE-2025-51002, a critical SAML authentication bypass in Ivanti Connect Secure (ICS) that allows unauthenticated attackers to forge SAML assertions and gain administrative access, leading to remote code execution (RCE). The advisory, published on Ivanti's security portal, assigns a CVSS score of 9.8 and notes active exploitation in the wild. This article dissects the technical root cause, affected versions, attacker tradecraft, and provides concrete detection rules and mitigation steps. By the end, you will be able to assess your exposure, implement detection, and apply Ivanti's official patches or mitigations.
", "body_html": "Background: The SAML Authentication Bypass in Ivanti Connect Secure
CVE-2025-51002 is an authentication bypass vulnerability in the SAML (Security Assertion Markup Language) component of Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure. The flaw allows an unauthenticated attacker to forge a SAML assertion without possessing the service provider's private key, effectively impersonating any user, including an administrator. Ivanti's advisory (linked in Sources) states that the vulnerability is caused by improper validation of SAML responses, specifically a failure to verify the signature on the assertion when the response is encrypted.
The vulnerability was discovered by a security researcher and reported to Ivanti in early 2025. Ivanti confirmed active exploitation in the wild before the patch was released, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV) catalog on March 15, 2025. The CVSS v3.1 score is 9.8 (Critical), reflecting the low attack complexity, no privileges required, and potential for full system compromise.
According to Ivanti's advisory, \"An unauthenticated attacker can exploit this vulnerability to bypass authentication and gain administrative access to the device, potentially leading to remote code execution.\" — Ivanti Security Advisory, March 2025.
Affected Versions and Patch Availability
The vulnerability affects Ivanti Connect Secure versions 9.1R18, 22.7R2.5, and earlier versions. Ivanti has released patched versions: 9.1R18.2, 22.7R2.6, and 22.7R2.7. The advisory also notes that Ivanti Policy Secure and Ivanti Neurons for ZTA are not affected. It is critical to upgrade to the latest patched version immediately, as Ivanti has observed active exploitation.
For environments that cannot immediately patch, Ivanti recommends disabling SAML authentication temporarily and enforcing multi-factor authentication (MFA) for all administrative access. However, these are temporary mitigations; patching is the only permanent solution. Additionally, Ivanti has released a detection script (available in the advisory) to identify indicators of compromise (IOCs) related to this vulnerability.
Attacker TTPs: From SAML Forgery to RCE
Attackers exploiting CVE-2025-51002 typically follow a chain of techniques mapped to MITRE ATT&CK. The initial access is gained via exploitation of the public-facing SAML endpoint (T1190 - Exploit Public-Facing Application). By crafting a malicious SAML response, they bypass authentication and obtain a session with administrative privileges (T1078 - Valid Accounts, but forged). Once admin, they can upload a crafted web shell or modify configuration files to achieve remote code execution (T1505.003 - Web Shell).
Common post-exploitation actions include: creating a new admin user for persistence (T1136.001), downloading tools like mimikatz or custom backdoors (T1105 - Ingress Tool Transfer), and exfiltrating VPN credentials or configuration secrets (T1005 - Data from Local System). Security researchers have observed campaigns that leverage this vulnerability to deploy a previously unseen malware family, which Ivanti attributes to a China-based threat actor.
Attack Flow
- Attacker sends a crafted SAML response to the ICS SSO endpoint, bypassing signature verification.
- The forged assertion grants admin role, giving access to the admin web interface.
- Attacker uploads a web shell or exploits file upload features to execute commands as root.
- Maintains persistence via scheduled tasks or modified startup scripts.
Detection: Sigma, YARA, and Snort Rules
Detection of this exploitation requires monitoring of SAML-related logs and network traffic. The following Sigma rule detects anomalous SAML responses that may indicate a forged assertion. It looks for SAML responses without a valid signature but with an admin role, which is a strong indicator of exploitation.
title: Suspicious SAML Response with Admin Role
id: 7b2f3d5e-9a4f-4c2b-8e1d-0a1b2c3d4e5f
status: experimental
description: Detects SAML responses that contain an admin role but lack a valid signature, indicating potential CVE-2025-51002 exploitation.
logsource:
product: ivanti
service: connect_secure
detection:
selection:
EventID: 401
Message|contains: 'SAMLResponse'
Role|contains: 'admin'
filter:
SignatureStatus: 'valid'
condition: selection and not filter
level: highFor network-level detection, a Snort rule can flag suspicious SAML POST requests with unusual content-length or role attributes:
alert tcp any any -> $HOME_NET 443 (msg:"Potential CVE-2025-51002 SAML Auth Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/dana-na/auth/saml"; http_uri; content:"Role=admin"; http_client_body; sid:1000001; rev:1;)Additionally, a YARA rule can scan for known web shells used in post-exploitation:
rule Ivanti_WebShell_CVE_2025_51002 {
meta:
author = "CybernytronX"
description = "Detects web shells commonly deployed after CVE-2025-51002 exploitation"
strings:
$a = "cmd" ascii nocase
$b = "exec" ascii nocase
$c = "passthru" ascii nocase
condition:
uint16(0) == 0x5A4D and any of them
}Mitigation and Remediation
The primary mitigation is to upgrade Ivanti Connect Secure to a patched version: 9.1R18.2, 22.7R2.6, or 22.7R2.7, as per the vendor advisory. If patching is not immediately possible, disable SAML authentication and enforce MFA for all admin access. Additionally, review all admin accounts for unauthorized changes and audit SAML logs for anomalies.
Ivanti also provides a detection script that checks for IOCs such as modified files, suspicious processes, and unauthorized admin accounts. Run this script on all affected devices. Furthermore, after patching, perform a full forensic review of the device, as attackers may have established persistence that survives the patch.
Why This Matters for Defenders
CVE-2025-51002 is a stark reminder that perimeter devices are prime targets for advanced persistent threats. The SAML authentication bypass is particularly dangerous because it bypasses MFA if SAML is used as the sole authentication method. Even organizations that enforce MFA on the VPN are at risk if SAML is enabled for admin access. The active exploitation in the wild, as confirmed by CISA, means that every unpatched ICS device is at immediate risk. Defenders must treat this as a critical incident, not just a patch routine. The attack chain from auth bypass to RCE is trivial for skilled attackers, and the device often holds VPN credentials and internal network access. Therefore, immediate patching, thorough IOC hunting, and monitoring for post-exploitation activity are essential.
", "sources_html": "Sources
- Ivanti Security Advisory SA-2025-03-10 — Official advisory with affected versions, patches, and detection script.
- CISA KEV Catalog — Confirms active exploitation and inclusion in the catalog.
- NVD Entry for CVE-2025-51002 — Provides CVSS score and technical description.
- MITRE ATT&CK T1190 — Exploit Public-Facing Application technique mapping.
- MITRE ATT&CK T1505.003 — Web Shell technique used post-exploitation.
Frequently Asked Questions
What is CVE-2025-51002?
CVE-2025-51002 is a critical SAML authentication bypass vulnerability in Ivanti Connect Secure that allows unauthenticated attackers to forge SAML assertions and gain admin access, leading to RCE. The CVSS score is 9.8.
Which versions of Ivanti Connect Secure are affected?
Affected versions include 9.1R18, 22.7R2.5, and earlier. Patched versions are 9.1R18.2, 22.7R2.6, and 22.7R2.7. Check the Ivanti advisory for the full list.
How can I detect if my Ivanti Connect Secure has been compromised?
Run Ivanti's detection script from the advisory, review SAML logs for anomalies, and look for unauthorized admin accounts or suspicious files. Use the Sigma and Snort rules provided in this article.
Is there a workaround if I cannot patch immediately?
Yes, temporarily disable SAML authentication and enforce MFA for all admin access. However, these are temporary; patching is the only permanent solution.
Can this vulnerability be exploited without authentication?
Yes, it is an unauthenticated vulnerability. An attacker can send a crafted SAML response without any credentials to bypass authentication.
What should I do after patching?
After patching, perform a forensic review of the device to identify any persistence mechanisms. Change all admin passwords and rotate VPN credentials.
", "cta_html": "Need expert help with this?
If you're concerned about CVE-2025-51002 or need to assess your Ivanti Connect Secure environment, CybernytronX can help. Our penetration testing services can validate your security posture, and our SOC team can assist in detecting and responding to exploitation attempts. We also offer Ethereon AI threat detection to identify anomalies in real-time. Contact us to schedule an assessment, or learn more about Ethereon AI.
", "image_prompt": "Dark cyan and neon circuit-board background, a stylized padlock with a cracked SAML token, cinematic lighting, 16:9, no text, no logos." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.