New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances

Cybersecuritynews •Guru Baran • July 30, 2026

A critical vulnerability, dubbed CosmosEscape, in Microsoft Azure Cosmos DB could have let attackers seize control of virtually every database hosted on the service, including Microsoft’s own internal systems. The vulnerability resided in Cosmos DB’s Gremlin API and, if exploited, could have enabled a cross-tenant attack affecting millions of customer workloads and Microsoft’s internal infrastructure. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CosmosEscape Vulnerability Exposes Azure Cosmos DB to Potential Attacks Wiz Research disclosed a critical vulnerability named CosmosEscape in Azure Cosmos DB, allowing attackers to potentially compromise every database in the service, including Microsoft's internal systems like Entra ID, Teams, and Copilot. The flaw, residing in the Gremlin API, could have enabled attackers to acquire the Cosmos Master Key, granting full read and write access to databases. This vulnerability posed a significant risk of cross-tenant attacks, potentially impacting millions of workloads. Microsoft has since remediated the issue by eliminating the Cosmos Master Key and has confirmed no evidence of exploitation. Security experts emphasize the importance of reviewing security postures despite the patch, as traditional tools may not detect such vulnerabilities. The incident serves as a reminder of the inherent risks in shared cloud infrastructure. 6 sources 71

Extracted Entities

New CosmosEscape Vulnerability Lets Attackers Take Over Azure Cosmos DB Instances

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Platforms (2)

Vulnerabilities (1)