Azure Bastion Elevation of Privilege Vulnerability
CVE-2025-49752 is an elevation of privilege vulnerability in Software for Open Networking in the Cloud (SONiC) (rated Critical, CVSS 10.0). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2025-49752- Products
- Software for Open Networking in the Cloud (SONiC)
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 10.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2025-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-294: Authentication Bypass by Capture-replay
- MSRC revision
- 1.2
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-11-20:
Information published.
- Revision 1.1, 2025-11-20:
Corrected security updates table. This is an informational change only.
- Revision 1.2, 2025-11-21:
Updated acknowledgment.
Microsoft says
Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page