External risk intelligence

Azure Bastion Elevation of Privilege Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-49752

Azure Bastion is an internet-facing service designed specifically to provide secure remote access to internal resources via a web browser. As a managed gateway service, it is intended to be reachable from the internet to facilitate administrative connectivity, making its attack surface public-facing by design.

Microsoft Azure Bastion Developer

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Azure Bastion, a service designed for secure remote access to internal resources. This issue could allow unauthorized access and modification of sensitive information, impacting the integrity and confidentiality of your cloud environment. The main concern is to confirm its relevance and exposure within your specific deployments.

Allows unauthorized access to cloud resources.
Protects sensitive data and service integrity.
Verify exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could target Azure Bastion by exploiting a flaw in the Azure Bastion Developer component, potentially gaining elevated privileges. This could allow an attacker to access sensitive information or disrupt services.

No authentication required.
Publicly accessible service.
Elevation of privilege.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Azure Bastion could allow an unauthenticated attacker to gain elevated privileges. When supported by the advisory, this could affect system data and potentially lead to unauthorized access to sensitive information or service disruption.

System data and sensitive information.
Network access to the service.
Unauthorized access and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

For Azure Bastion Elevation of Privilege Vulnerability, the platform or infrastructure teams are likely responsible for managing the Azure Bastion service. The first practical step is to confirm the presence and reachability of Azure Bastion, identify the accountable owner, and assess its business criticality before planning remediation.

Platform/Infrastructure teams own the issue.
Verify Azure Bastion deployment and exposure.
Plan remediation based on criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Azure Bastion Developer component?

Azure Bastion is a managed platform-as-a-service (PaaS) that facilitates secure remote connectivity to virtual machines. The Developer SKU specifically provides a cost-effective, scaled-down version of this connectivity gateway, allowing administrators to access internal cloud resources directly through a web browser without exposing those resources to the public internet.

What does CVE-2025-49752 mean by Elevation of Privilege?

This vulnerability is classified as CWE-294. In the context of CVE-2025-49752, Elevation of Privilege means that an attacker could bypass standard identity checks to gain higher access rights than they are authorized to hold. This weakness effectively permits someone to act with the permissions of a more privileged user or administrator, potentially enabling them to read, modify, or disrupt resources normally protected by strict access controls.

How does an attacker trigger this vulnerability?

The flaw allows an unauthenticated attacker to exploit the service remotely. Because this is an Elevation of Privilege issue, the attacker does not need legitimate credentials to attempt an exploit. It is important to note that this bug is not triggered by typical administrative tasks or standard user connectivity sessions; it requires an active, malicious attempt to interact with the vulnerable service path.

Is my cloud environment at risk from this CVE?

According to Halo Surface Signal, because Azure Bastion is intentionally designed to provide remote access, the service is often exposed to the internet by nature of its function. You should assume the service is reachable from the public internet if you have deployed it, making it a relevant target for attackers scanning for this vulnerability. If your infrastructure relies on this service for remote connectivity, your risk profile is significantly higher.

What should I do if I use Azure Bastion?

Your first step is to locate all instances of Azure Bastion Developer within your cloud environment to confirm their deployment status. Identify the infrastructure or platform team responsible for managing these resources and verify the business criticality of each instance. Once identified, maintain close monitoring for official security updates from the provider to remediate the service.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49752

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.