A newly disclosed critical vulnerability in Azure Bastion, tracked as CVE-2025-49752, allows remote attackers to completely bypass authentication and elevate privileges to full administrative access. The flaw, rated CVSS high, impacts all Azure Bastion deployments prior to November 20, 2025, making it one of the most severe security risks affecting Azure this year. Categorized as an Authentication Bypass (CWE-294) issue, this vulnerability directly undermines the core purpose of Azure Bastion secure, identity-based remote access to cloud infrastructure.

The root of the flaw, according to Zeropath, lies in improper handling and validation of authentication tokens inside the Bastion service. Attackers can intercept valid credentials and replay them to bypass security controls entirely. Exploitation requires no user interaction, no prior privileges, and is executed through a single network request, making it trivial for an attacker on the network to gain administrative control. The impact extends beyond Bastion itself, allowing adversaries to compromise all virtual machines connected through the service.

Because the attack is fully network-exploitable, Azure customers face immediate exposure if the Bastion instance has not been updated. Microsoft has not specified version numbers, indicating that all configurations of the service were vulnerable until the November 20, 2025 security fix. The flaw joins other major Azure authentication-related issues reported this year, including CVE-2025-54914 and CVE-2025-29827, raising concerns about recurring weaknesses despite Microsoft’s ongoing Secure Future Initiative.

Security teams are strongly advised to apply the latest patches, verify Bastion configuration integrity, and conduct a full review of administrative access logs to detect suspicious activity. Organizations should also reassess network segmentation, access control boundaries, and isolation around Bastion deployments to reduce lateral movement opportunities. With its potential to compromise critical cloud workloads, CVE-2025-49752 demands urgent remediation and strategic tightening of Azure identity and access management practices.