Critical Flaw Allowed to Azure Cosmos DB Pwnage
Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access. The post Critical Flaw Allowed to Azure Cosmos DB Pwnage appeared first on SecurityWeek.
A critical vulnerability in the Azure Cosmos DB database service could have allowed attackers to compromise all databases on the service, cybersecurity outfit Wiz reports.
Referred to as CosmosEscape, the security defect could have allowed an attacker to obtain a platform-wide key and retrieve the primary key of any Cosmos DB account, gaining full read and write access across the service.
Armed with the key, an attacker could have listed all databases on the service, filtering them by specific organization identifiers, such as subscription and tenant IDs.
Source: https://www.securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/
Related breach coverage
- Ruby on Rails Patches Critical Vulnerability2026-08-01
The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE). The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.
- Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day2026-07-28
Impacting on-premises deployments, the OS command injection allows attackers to access privileged internal functionality. The post Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.
- PTC Windchill Vulnerability Exploited in Ransomware Campaign2026-07-27
The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication. The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.
- Splunk, Zoom Patch Critical Vulnerabilities2026-07-16
The flaws could allow attackers to access credentials and data, take over accounts, and escalate their privileges. The post Splunk, Zoom Patch Critical Vulnerabilities appeared first on SecurityWeek.