Loading story…
Microsoft has patched a critical Azure Cosmos DB vulnerability chain dubbed CosmosEscape that could have let an attacker move from a crafted Gremlin API query to code execution on a multi-tenant backend component and ultimately obtain secrets capable of accessing virtually any customer Cosmos DB account. Wiz reported that insufficient restrictions around .NET reflection allowed escape from the Gremlin sandbox, exposing a platform-wide signing secret—described as the Cosmos Master Key—and a regional account directory that could be used to locate target accounts and retrieve their primary keys.
With those primary keys, an attacker could have gained full read and write control over Cosmos DB deployments across SQL, MongoDB, Cassandra, and Gremlin APIs, including private databases across regions and potentially data tied to Microsoft services such as Entra ID, Teams, and Copilot. Microsoft said it blocked the vulnerable Gremlin entry point within 48 hours of Wiz’s November 2025 report, later completed broader fixes across all regions, removed the shared platform-wide key, and added controls to prevent similar backend access; the company said its review found no evidence of exploitation or customer data access beyond the researchers’ testing, and no customer action is required.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In July 2026, Microsoft completed broader fixes for the CosmosEscape issue across all regions and removed the platform-wide shared key. Microsoft said it also added controls to prevent similar access from the Gremlin processing environment.
Wiz reported a vulnerability chain in Azure Cosmos DB in November 2025. According to the disclosure, the chain could let an attacker escape the Gremlin query sandbox, execute code on a multi-tenant DB Gateway, expose a platform-wide signing secret, and ultimately retrieve primary keys for arbitrary customer Cosmos DB accounts.
Microsoft stated that its investigation found no unauthorized activity or exploitation beyond Wiz's controlled testing and that no customer data was accessed. The company said no customer action is required.
Microsoft blocked the vulnerable Gremlin entry point within 48 hours of Wiz's November 2025 report. This initial mitigation cut off the attack path used to escape the Gremlin environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
infoworld.com
Open sourcecsoonline.com
Open sourcesecurityweek.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcewiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft remediated a critical Azure Automation vulnerability, tracked as **`CVE-2025-29827`** and rated **CVSS 9.9**, that could have allowed an attacker to take over another tenant’s automation identity. The issue stemmed from a public-by-default Azure Automation configuration combined with additional code flaws, creating an exploit chain that let an attacker with access to their own Azure Automation account impersonate identities across tenants and potentially reach data, credentials, scripts, and other cloud resources. Reporting on the flaw said the attack path required three weaknesses: publicly exposed Azure Automation account endpoints by default and two separate code-level bugs. Microsoft said it changed the default behavior so Azure Automation identities are no longer public by default, and no known in-the-wild exploitation has been reported. The finding echoes earlier research into Azure Automation security and underscores how cloud identity exposure and chained logic flaws can turn default service settings into high-impact cross-tenant compromise paths.
Jul 24, 2026
Researchers at Enclave disclosed a critical improper authentication flaw in Microsoft's Azure SRE Agent that allowed an outsider with only a free Azure account to observe another organization's AI operations agent in real time. The cross-tenant exposure stemmed from a token issuance process that accepted accounts from any Microsoft cloud tenant and a communication channel that verified token validity but not tenant ownership, enabling unauthorized access to live agent sessions. Microsoft confirmed the issue, assigned `CVE-2026-32173`, rated it critical with a `CVSS` score of `8.6`, and remediated it server-side. According to the disclosure, exposed data could include user prompts, agent responses, step-by-step reasoning, executed commands, command output, and even plaintext credentials, while generating no logs visible to the victim organization, underscoring wider concerns that enterprise AI agent deployments are outpacing governance and security controls.
Jun 29, 2026
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026