A recently patched vulnerability in Azure Cosmos DB could have allowed attackers to gain full read and write access to databases across multiple customer tenants. This flaw, identified by security firm Wiz and dubbed ‘CosmosEscape,’ involved a series of exploits starting with a specially crafted query against a Gremlin database controlled by the attacker.
Azure Cosmos DB is a globally distributed, multi-model database service provided by Microsoft, supporting various APIs including SQL, MongoDB, Cassandra, and Gremlin. It is widely used for building scalable, high-performance applications.
The exploit chain began when an attacker executed a malicious query on their own Gremlin database. This action led to code execution on a multi-tenant gateway, a component responsible for processing customer queries within Azure’s infrastructure. Through this gateway, the attacker could access a platform-wide signing secret and a regional account directory. These credentials enabled the attacker to locate target databases and retrieve their primary account keys, effectively granting full control over those databases.
Microsoft responded promptly to the vulnerability report. Within 48 hours of being notified in November 2025, the company blocked the vulnerable Gremlin entry point. A comprehensive fix was implemented across all regions by July 2026, which included eliminating the platform-wide key to prevent similar exploits in the future.
Microsoft’s investigation concluded that no unauthorized activity occurred beyond the researchers’ testing, and no customer data was accessed. Consequently, no action is required from customers.
This incident underscores the critical importance of securing multi-tenant cloud services. Vulnerabilities in shared components can have far-reaching implications, potentially affecting numerous customers. It highlights the necessity for continuous security assessments and prompt remediation to maintain the integrity and trustworthiness of cloud platforms.
