High

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

The Hacker News

July 30, 2026 at 1:34 PM

Overview

A recently patched vulnerability in Azure Cosmos DB, identified by researchers at Wiz and named CosmosEscape, posed a significant risk to users by potentially allowing attackers to bypass the service's Gremlin query sandbox. This flaw could have granted full read and write access to all databases across various customer accounts. The exploit began with a specially crafted query directed at a Gremlin database that the attacker controlled. This incident is particularly concerning as it underscores the possibility of extensive data exposure across multiple tenants, which could have had severe implications for organizations relying on Azure Cosmos DB for their data storage needs. Companies using this service should ensure they have applied the latest patches to safeguard their databases.

Key Takeaways

Affected Systems: Azure Cosmos DB
Action Required: Patches have been released; users should update their Azure Cosmos DB instances to the latest version.
Timeline: Newly disclosed

Original Article Summary

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a

Impact

Azure Cosmos DB

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Patches have been released; users should update their Azure Cosmos DB instances to the latest version.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Vulnerability.

Read Original Article

Related Coverage

CISA issues recommendations to federal agencies on open-source software security

CyberScoop

The Cybersecurity and Infrastructure Security Agency (CISA) has released new recommendations aimed at improving the security of open-source software used by federal agencies. This guidance includes best practices for managing vulnerabilities, particularly in open-weight AI models and the importance of timely patching. Experts in the field have expressed approval of these recommendations, noting that they address significant security concerns surrounding open-source software. The move is particularly relevant as more agencies adopt open-source solutions, which can be both beneficial and risky if not properly secured. By following CISA's advice, federal agencies can better protect their systems and data from potential threats.

Jul 30, 2026

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

The Hacker News

Researchers have linked a new macOS malvertising campaign to North Korean actors, who are using deceptive tactics to deliver malware. The attackers redirect users to fake web pages that mimic legitimate macOS update screens, tricking them into thinking they need to install an update. Once users interact with these screens, malware is installed on their devices, specifically designed to steal cryptocurrency. This campaign is a continuation of the ongoing Contagious Interview campaign, raising concerns about the security of macOS users who may fall victim to these tactics. It serves as a reminder for users to be cautious of unexpected update prompts and to verify the legitimacy of software updates before proceeding.

Jul 30, 2026

What the FCC ban on foreign-made robot vacuums means for your Roomba

Read This Before You Buy That TV Streaming Stick

Krebs on Security

Security experts have raised significant concerns about generic TV streaming devices that offer unlimited content for a one-time fee. These devices not only risk your internet connection being rented out to strangers but are also involved in more sophisticated scams. A recent analysis reveals that these devices often impersonate mobile phones to click on ads on AI-generated websites, which is part of a larger scheme to defraud online merchants and advertising networks. This poses a risk not only to users' personal data but also affects the integrity of online advertising systems, potentially leading to financial losses for companies and advertisers. Users should be cautious about using such devices and consider the broader implications for their online security.

Jul 30, 2026

OpenAI's rogue agent didn't stop at Hugging Face - here's what we know

After the Break-In: What Attackers Do Once They're Already Inside

BleepingComputer

Attackers often continue their malicious activities after they gain access to a network, rather than halting their operations. A recent analysis by Huntress examined a real-world intrusion, revealing how these threat actors establish long-term control within compromised systems, disable security measures, and manipulate the environment to their advantage. The findings emphasize that cybersecurity defenders need to focus on identifying and addressing the original entry points of attacks instead of merely removing malware. This approach is crucial because understanding how attackers infiltrate systems can help prevent future breaches and improve overall security posture. Organizations must prioritize thorough investigations and proactive measures to safeguard their networks against these persistent threats.

Jul 30, 2026