Official Website of Azure Noob
CVE-2025-49752: Critical Azure Bastion Vulnerability - What You Need to Know Right Now

CVE-2025-49752: Critical Azure Bastion Vulnerability - What You Need to Know Right Now

2025-11-22 · ~12 min read

CVSS 10.0 authentication bypass in Azure Bastion lets attackers escalate to admin without credentials. Microsoft patched it November 20th. Here's what Azure admins need to do immediately.

If you're using Azure Bastion, stop what you're doing and read this.

Microsoft disclosed CVE-2025-49752 on November 20, 2025. It's a CVSS 10.0 authentication bypass vulnerability in Azure Bastion that allows remote attackers to escalate privileges to admin level without any credentials.

This isn't theoretical. The vulnerability is remotely exploitable, requires no user interaction, and gives attackers administrative access to every VM connected through your Bastion host.

Here's what you need to know and do right now.

What Is CVE-2025-49752?

CVE-2025-49752 is an authentication bypass vulnerability in Azure Bastion classified as CWE-294 (Authentication Bypass by Capture-replay).

The attack:
1. Attacker intercepts valid authentication tokens or session credentials
2. Replays those tokens to Azure Bastion
3. Gains administrative access to all VMs accessible through the Bastion host
4. No authentication required, no user interaction needed

CVSS Score: 10.0 (Critical - Maximum severity)

Attack Vector:
- Network-accessible from anywhere
- No prior authentication required
- No special privileges needed
- No user interaction required
- Remote exploitation

Impact:
- Complete compromise of all VMs behind the affected Bastion
- Administrative privilege escalation
- Potential lateral movement across your Azure environment

Why This Is Worse Than It Sounds

Azure Bastion is your secure remote access gateway. Organizations use it specifically to:
- Avoid exposing RDP/SSH ports to the internet
- Provide controlled, audited access to VMs
- Implement zero-trust network access

When Bastion is compromised, your entire security model breaks.

If an attacker bypasses Bastion authentication:
- They have admin access to every VM you protected with Bastion
- Your audit logs show "legitimate" Bastion sessions
- Network security groups that block direct RDP/SSH are useless
- You thought you were secure - but the front door was wide open

Real-world scenario:
- Production VMs: 50 servers behind Azure Bastion
- Attack surface: One authentication bypass
- Blast radius: All 50 servers fully compromised
- Detection difficulty: High (looks like normal Bastion traffic)

This is the third critical Azure privilege escalation vulnerability in 2025:
1. CVE-2025-54914 (Azure Networking, CVSS 10.0)
2. CVE-2025-29827 (Azure Automation, CVSS 9.9)
3. CVE-2025-49752 (Azure Bastion, CVSS 10.0)

Pattern: Authentication and privilege escalation flaws in core Azure services.

What Azure Admins Need to Do Immediately

1. Verify Your Bastion Instances Are Patched

Microsoft released patches on November 20, 2025. Azure Bastion is a managed service, but you need to verify the patch was applied.

Check patch status:

# List all Azure Bastion instances
Get-AzBastion | Select-Object Name, ResourceGroupName, ProvisioningState, Location

# Check specific Bastion version/status
Get-AzBastion -Name "YourBastionName" -ResourceGroupName "YourRG" | 
  Select-Object Name, ProvisioningState, Sku

What to look for:
- ProvisioningState should be Succeeded
- If status shows Updating, the patch is being applied
- If status shows Failed, contact Azure support immediately

Managed service caveat: Azure Bastion patches are typically auto-applied, but don't assume. Verify explicitly.

2. Audit Recent Bastion Access Logs

Check for suspicious activity before the patch was applied.

Query Azure Activity Logs:

AzureActivity
| where ResourceProvider == "Microsoft.Network"
| where ResourceType == "bastionHosts"
| where TimeGenerated >= ago(30d)
| where OperationNameValue contains "Microsoft.Network/bastionHosts"
| project TimeGenerated, Caller, OperationNameValue, ActivityStatusValue, 
          ResourceId, Properties
| order by TimeGenerated desc

Look for:
- Unusual authentication attempts
- Access from unexpected IP addresses
- Admin-level operations during off-hours
- Multiple failed auth attempts followed by success (token replay pattern)

Query Bastion diagnostic logs (if enabled):

AzureDiagnostics
| where ResourceType == "BASTIONHOSTS"
| where Category == "BastionAuditLogs"
| where TimeGenerated >= ago(30d)
| project TimeGenerated, UserName, Protocol, SourceIPAddress, TargetVMName, 
          OperationName, ResultType
| order by TimeGenerated desc

Red flags:
- Same username connecting from different IPs within short timeframes
- Connections to VMs the user doesn't normally access
- Failed connections immediately followed by successful ones
- Authentication from geographic locations that don't match your organization

3. Enable Enhanced Logging (If Not Already)

If you don't have Bastion diagnostic logging enabled, enable it now.

Enable diagnostic logging:

# Enable Bastion diagnostics to Log Analytics
$bastion = Get-AzBastion -Name "YourBastionName" -ResourceGroupName "YourRG"
$workspace = Get-AzOperationalInsightsWorkspace -Name "YourWorkspace" -ResourceGroupName "YourRG"

Set-AzDiagnosticSetting -ResourceId $bastion.Id -Name "BastionLogs" `
  -WorkspaceId $workspace.ResourceId `
  -Enabled $true `
  -Category "BastionAuditLogs"

What logs to capture:
- BastionAuditLogs (all connection attempts)
- AzureActivity (infrastructure changes)
- Resource Health (service status)

Retention: Set to at least 90 days for compliance and forensic analysis.

4. Implement Additional Network Segmentation

While you're patching, add defense-in-depth controls:

Network Security Group (NSG) hardening:

# Get VMs connected through Bastion
$vms = Get-AzVM | Where-Object {
    $_.NetworkProfile.NetworkInterfaces | 
    ForEach-Object { $nic = Get-AzNetworkInterface -ResourceId $_.Id; 
                     $nic.IpConfigurations.Subnet.Id -match "BastionSubnet" }
}

# Apply restrictive NSG rules
# (Example: Limit Bastion subnet to only known management IPs)
$nsg = Get-AzNetworkSecurityGroup -Name "Bastion-NSG" -ResourceGroupName "YourRG"

# Add rule restricting inbound traffic
$nsg | Add-AzNetworkSecurityRuleConfig `
  -Name "Restrict-Bastion-Management" `
  -Priority 100 `
  -Direction Inbound `
  -Access Allow `
  -Protocol Tcp `
  -SourceAddressPrefix "YourManagementIPRange" `
  -SourcePortRange "*" `
  -DestinationAddressPrefix "*" `
  -DestinationPortRange "443,3389,22" | 
Set-AzNetworkSecurityGroup

Firewall rules:
- Limit Bastion subnet outbound access to only necessary VM subnets
- Block internet egress from Bastion subnet (shouldn't need it)
- Enable Azure Firewall for additional traffic inspection

5. Review and Restrict Bastion RBAC Permissions

Audit who has access to create/modify Bastion resources:

AzureActivity
| where Authorization contains "Microsoft.Network/bastionHosts"
| where TimeGenerated >= ago(90d)
| summarize Count = count() by Caller, OperationNameValue, ActivityStatusValue
| order by Count desc

Principle of least privilege:
- Only network admins should have Microsoft.Network/bastionHosts/write
- Use Azure PIM for just-in-time admin access
- Remove standing admin permissions

6. Set Up Alerts for Bastion Anomalies

Create alerts to detect potential exploitation attempts:

Alert on unusual Bastion access patterns:

let NormalUsers = dynamic(["admin@company.com", "netadmin@company.com"]);
AzureDiagnostics
| where ResourceType == "BASTIONHOSTS"
| where UserName !in (NormalUsers)
| where Protocol in ("ssh", "rdp")
| summarize ConnectionCount = count() by UserName, SourceIPAddress, bin(TimeGenerated, 1h)
| where ConnectionCount > 5  // Threshold
| project TimeGenerated, UserName, SourceIPAddress, ConnectionCount

Alert on Bastion infrastructure changes:

AzureActivity
| where ResourceProvider == "Microsoft.Network"
| where ResourceType == "bastionHosts"
| where OperationNameValue in (
    "Microsoft.Network/bastionHosts/write",
    "Microsoft.Network/bastionHosts/delete"
  )
| where Caller !in ("known-admin@company.com")
| project TimeGenerated, Caller, OperationNameValue, ResourceId, CorrelationId

Technical Details: How the Attack Works

CWE-294: Authentication Bypass by Capture-replay

The vulnerability allows an attacker to:
1. Capture: Intercept valid Bastion authentication tokens during a legitimate session
2. Replay: Send the captured token back to Bastion
3. Escalate: Bastion accepts the replayed token and grants admin-level access

Why it works:
- Bastion doesn't properly validate token freshness
- No nonce or timestamp verification on authentication tokens
- Replay protection mechanisms are missing or bypassable

Attack requirements:
- Network access to Azure Bastion endpoint (internet-accessible by design)
- Ability to capture a single valid token (MITM, network sniffing, compromised endpoint)
- No credentials, no user interaction, no special privileges

This is why the CVSS is 10.0. The attack surface is enormous and exploitation is trivial.

What Microsoft Should Have Done (And Didn't)

Azure Bastion is a managed service. Microsoft controls:
- The authentication mechanisms
- Token validation logic
- Session management
- Patching and updates

This vulnerability shouldn't exist.

Authentication replay attacks are well-known. The mitigations are well-documented:
- Token nonces (one-time use)
- Timestamp validation (tokens expire)
- Mutual authentication (verify both client and server)
- Token binding (tie tokens to TLS sessions)

None of these were properly implemented.

This is the third CVSS 10.0 vulnerability in Azure services in 2025. All three involve authentication or privilege escalation flaws in managed services that Microsoft fully controls.

Pattern recognition: Microsoft's Secure Future Initiative isn't preventing critical authentication bugs in production Azure services.

What Happens If You Were Compromised?

If an attacker exploited CVE-2025-49752 before you patched:

Assume breach:
1. All VMs accessible through the compromised Bastion are potentially compromised
2. Attacker had admin-level access (full control)
3. Lateral movement to other Azure resources is likely

Incident response steps:

  1. Isolate affected VMs
  2. Snapshot VMs for forensics

  3. Disconnect from network (don't delete - preserve evidence)

  4. Rotate all credentials

  5. Change VM administrator passwords
  6. Rotate service principal secrets
  7. Regenerate SSH keys

  8. Revoke and reissue certificates

  9. Hunt for persistence mechanisms

  10. Check for backdoor accounts
  11. Review scheduled tasks / cron jobs
  12. Audit firewall rule changes

  13. Check for unauthorized software installations

  14. Review audit logs across Azure

  15. Azure Activity Logs (infrastructure changes)
  16. Azure AD Sign-in Logs (identity compromise)
  17. NSG Flow Logs (network traffic patterns)

  18. Storage access logs (data exfiltration)

  19. Engage incident response

  20. If you have sensitive data, assume exfiltration
  21. Notify compliance/legal teams
  22. Consider third-party forensics

The Bigger Picture: Azure Security in 2025

Three critical (CVSS 10.0) authentication bugs in one year suggests systemic issues:

  1. Authentication logic isn't being threat-modeled properly
  2. Code reviews aren't catching replay vulnerabilities
  3. Security testing isn't covering token validation edge cases

For Azure administrators:
- Assume Microsoft's managed services have vulnerabilities
- Implement defense-in-depth (don't rely on single control points)
- Monitor everything (logs, metrics, anomalies)
- Patch immediately when Microsoft releases updates
- Use Azure Defender/Sentinel for threat detection

Azure Bastion was supposed to be the secure option. Turns out, it had a CVSS 10.0 auth bypass the whole time.

Action Items (Priority Order)

Today (Critical):
1. ✅ Verify all Bastion instances are patched
2. ✅ Audit Bastion access logs for past 30 days
3. ✅ Enable diagnostic logging if not already enabled

This Week (High):
4. ✅ Implement NSG restrictions on Bastion subnets
5. ✅ Set up alerts for Bastion anomalies
6. ✅ Review RBAC permissions on Bastion resources

This Month (Medium):
7. ✅ Add network segmentation around critical VMs
8. ✅ Implement Azure Sentinel detection rules for Bastion
9. ✅ Document incident response procedures for Bastion compromise

Resources

Microsoft Security Update:
- CVE-2025-49752 Official Advisory

Detection Queries:
- KQL queries above for Log Analytics / Azure Sentinel

Patch Verification:
- PowerShell commands above to check Bastion status

Further Reading:
- Azure Bastion Documentation
- CWE-294: Authentication Bypass by Capture-replay

Bottom line: CVE-2025-49752 is a critical vulnerability that undermines the entire purpose of Azure Bastion. Patch immediately, audit your logs, and add defense-in-depth controls.

Don't assume Microsoft's "secure" managed services are actually secure. This is the third CVSS 10.0 auth bug in Azure this year.

Verify, monitor, and assume breach until you confirm otherwise.

Managing 44 Azure subscriptions and 31,000 resources taught me: Always verify patches actually deployed, and always audit after critical vulnerabilities. Trust, but verify.

Get Azure tips in your inbox

Join Azure pros getting practical KQL queries, cost optimization tips, and real-world solutions.