Product:
Azure Bastion
Summary
Azure Bastion has a critical elevation of privilege vulnerability that could allow an attacker to gain elevated access to the system. This vulnerability is characterized by low attack complexity and requires no user interaction. If exploited, it can lead to significant impacts on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 10 | CVE-2025-49752 |
Exploitation
To exploit this vulnerability, an attacker would need to have network access to the Azure Bastion service. Given the low attack complexity and no required privileges, an attacker could potentially execute malicious actions that compromise the system’s security and gain unauthorized access.
Affected Products
- Azure Bastion: A service that provides secure and seamless RDP and SSH connectivity to virtual machines directly in the Azure portal over SSL.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, organizations should review their network security configurations and access controls to limit exposure to potential attacks.