Introduction
No cloud security team wants to face an attacker who gains administrative access to Azure-hosted virtual machines through a single network request. CVE-2025-49752 is a critical authentication bypass vulnerability in Azure Bastion that could allow remote privilege escalation, which puts cloud infrastructure at organizations worldwide directly at risk.
Azure Bastion is a Microsoft managed service that provides secure RDP and SSH connectivity to Azure virtual machines without exposing those VMs directly to the internet. Enterprises deploy it widely for centralized, secure administrative access.
Technical information
CVE-2025-49752 is categorized as CWE-294 (Authentication Bypass by Capture-replay). In this class of vulnerability, an attacker intercepts valid authentication tokens or credentials and replays them to gain unauthorized access. In Azure Bastion, a remote attacker could use this to escalate to administrative privileges and reach every VM the Bastion host can reach.
The vulnerability is remotely exploitable, requires no user interaction, and targets the authentication mechanisms in the Bastion service. The CVSS score of 10.0 reflects that an attacker can exploit it over the network without prior authentication or special privileges. As of the reporting date, no public code snippets or detailed root-cause disclosures are available, and no proof of concept or exploitation in the wild has been reported.
Affected systems and versions
- Product: Microsoft Azure Bastion
- Affected: All Azure Bastion deployments prior to the security update released on November 20, 2025
- Available advisories publish no specific version numbers or SKU restrictions
- All configurations using Azure Bastion for RDP or SSH access are potentially affected
Vendor security history
Microsoft Azure has had several critical privilege escalation vulnerabilities in 2025, including:
- CVE-2025-54914 (Azure Networking, CVSS 10.0)
- CVE-2025-29827 (Azure Automation, CVSS 9.9)
- CVE-2025-55241 (Azure Entra ID, CVSS 9.0)
Microsoft patches on a monthly cycle and has launched the Secure Future Initiative to improve security in its development process. Even so, authentication and privilege escalation issues keep recurring across Azure services.
