An authentication bypass vulnerability has been discovered in Azure Bastion , Microsoft’s managed service that enables secure RDP and SSH connections to virtual machines in Azure without directly exposing them to the Internet.
The flaw, identified as CVE-2025-49752 , potentially allows a remote attacker to gain administrative privileges on all VMs accessible via Bastion.
CVE-2025-49752 falls under the category of CWE-294 – Authentication Bypass by Capture-Replay , which involves the interception and reuse of valid tokens or credentials to gain unauthorized access .
In the case of Azure Bastion, this could allow privilege escalation to the administrative level, without requiring user interaction.
The vulnerability is remotely exploitable , requires no pre-existing privileges, and has a CVSS score of 10.0 , the maximum, as the attack can only be conducted over a network.
To date, no source code details or proof-of-concept have been published , and there are no reports of active exploitation in a real-world environment.
As of 2025, Microsoft Azure has already addressed other critical privilege escalation vulnerabilities, including:
Microsoft maintains a monthly update cycle and has launched the Secure Future initiative to strengthen security in cloud service development. Despite these efforts, authentication and privilege escalation vulnerabilities continue to emerge in various Azure services.
Azure Bastion is a Microsoft-managed service that allows users to securely connect to virtual machines (VMs) on Azure via Remote Desktop Protocol (RDP) or SSH , without exposing the VMs directly to the internet. With this solution, companies can significantly reduce the risk of external attacks and protect their login credentials.
Azure Bastion acts as a secure bridge between the user and the virtual machine. Access is via the Azure portal, using an encrypted connection. This eliminates the need to open public ports on the VMs, reducing the risk of intrusion.
Azure Bastion is widely adopted by organizations that require secure administrative access to VMs, such as software development, test environments, cloud server management, and remote IT support.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
