"No customer data was accessed and no customer action is required," Microsoft said after a vulnerability in Azure Cosmos DB that researchers call CosmosEscape was patched.
Wiz's CosmosEscape exploit chain and starting conditions
Security firm Wiz published a technical account of an exploit chain it codenamed CosmosEscape. According to Wiz, the chain began with a crafted query against a Gremlin database controlled by the attacker and credentials for that account; it did not start with access to a victim's database. The public record notes Microsoft’s current connection guide requires an account host, database, graph path and primary key before a client can submit Gremlin queries, and Wiz has not published whether the exploit required anything beyond that starting point.
How the Gremlin engine and .NET reflection were used
Wiz said Cosmos DB’s custom Gremlin engine translates Gremlin queries into .NET code and runs that code inside a restricted environment. The researchers report those restrictions failed to account for .NET reflection, which let them construct file-read and file-write primitives and escalate to arbitrary code execution. The public disclosure shows the output of a crafted query that executed the hostname command on the Cosmos DB backend, though Wiz has not published the query text itself. Wiz plans to present the complete exploit chain at a Black Hat USA briefing on August 6.
DB Gateway, the Cosmos Master Key, and the Config Store
The researchers say their code execution landed on a component they call the DB Gateway. That gateway executes customer queries on multi-tenant Azure Service Fabric clusters. Customer databases were not stored on those clusters, but the gateway had the ability to retrieve the primary key for a requested Cosmos DB account. Microsoft documentation says a Cosmos DB account primary key grants full control over all resources in that account.
Wiz reported the gateway also had access to a signing key the researchers dubbed the Cosmos Master Key. That signing key, Wiz said, could be used to retrieve the primary key for any account across tenants, regions, and across Cosmos DB's SQL, MongoDB, Cassandra and Gremlin APIs. The same secret provided access to a regional Config Store — described by Wiz as a directory containing Cosmos DB account names, subscription and tenant identifiers, network settings, and tags — which could be used to locate a particular organization’s accounts and then request their primary keys.
Scope, isolation, and Microsoft’s response
Wiz said the exploit chain could reach private and network-isolated accounts because the compromised gateway enforced those network boundaries from inside the service. The researchers’ write access to the Config Store suggested that network settings could also be changed, although Wiz’s report does not say they demonstrated that against another customer's account.
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of Wiz’s November 2025 report. The company completed a longer-term fix across all regions in July 2026 and eliminated the platform-wide key, Microsoft said. Microsoft’s review found no unauthorized activity outside the researchers’ testing, the company said; it stated no customer data was accessed and no customer action is required.
Potential exposure to Microsoft products and outstanding timeline questions
Microsoft documentation cited by Wiz indicates some Microsoft services store data in Cosmos DB: documentation states Teams message data remains in Cosmos DB, and a Microsoft engineering post says Copilot stores users’ queries and conversation histories there. Wiz said databases supporting those products were potentially accessible under the described chain, but explicitly did not report accessing their data.
The public record does not say when the vulnerable Gremlin engine and signing-key path first entered production, nor what period Microsoft’s log review covered. Because those dates and the log-review window are not specified, the duration of any potential exposure remains unknown, even though the known path has been closed.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: Will scrutinize multi-tenant gateway controls and the handling of signing keys that can span tenants, APIs and regions — Wiz’s write-up centers the risk created when an internal gateway holds a broadly capable signing secret.
- Affected enterprises and procurement leaders: Need to note Microsoft’s statement that no customer action is required while also tracking Microsoft’s remediation timeline and log-review scope, since the public record leaves the exposure window unspecified.
- Adversaries and threat actors: The chain described by Wiz shows a path from a customer-controlled Gremlin endpoint to platform-level secrets; Wiz’s findings identify attack primitives adversaries would target where similar multi-tenant gateways and signing keys exist.
The record closes on a concrete remediation — Microsoft removed the platform-wide key and applied fixes globally by July 2026 — but leaves a technical and forensic blunt point: the community will await Wiz’s full disclosure at Black Hat on August 6 and will press for clarity on when the vulnerable code and signing path entered service and what log periods were reviewed. The answers will determine how long any tenant might have been at risk and whether further mitigations are needed.
Original reporting: https://thehackernews.com/2026/07/azure-cosmos-db-flaw-exposed-platform.html
