Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-31 · high
Microsoft shipped a hotfix within two days but didn't finish rebuilding the vulnerable service until July 2026.
Why now: Wiz published the technical write-up July 30, capping a disclosure that ran from November 2025's report to July 2026's rebuild.
Wiz broke out of a sandboxed database engine inside Azure Cosmos DB and reached the master key for every tenant, the company disclosed July 30.
That key, held by Cosmos DB's Gateway service, unlocks primary keys for any account in any tenant or region. It also opens a Config Store listing every account on the platform.
Entra ID, Teams and Copilot all store data in Cosmos DB, so the exposure reached past Azure customers into Microsoft's own services.
The path in ran through Gremlin, Cosmos DB's graph query engine. A chain of .NET reflection tricks broke that sandbox and ran code on the DB Gateway, the service holding the master key.
Microsoft got the report on November 20, 2025, and shipped a hotfix two days later. The real fix, rebuilding how DB Gateway isolates that key, didn't finish until July 2026. Wiz's writeup doesn't say why the rebuild took that long.
Wiz credits an early version of Atlas, its AI vulnerability researcher, with helping find the bug.
Two days for the patch, eight months for the rebuild. That gap points to the real flaw: one master key behind a single sandboxed engine for every tenant. If Cosmos DB ships another sandbox escape, watch whether Microsoft contains it to one tenant this time.
Each link below shares sources, entities, or timing with this story.
.NET built by Microsoft / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, July, Microsoft; overlapping topics (code, copilot).
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, Microsoft, Teams; overlapping topics (code, copilot).
.NET built by Microsoft / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, Microsoft; overlapping topics (architectural, code).
Atlas built by OpenAI / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Atlas built by OpenAI); both cover Copilot, July; overlapping topics (code, copilot).
.NET built by Microsoft / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, Microsoft; overlapping topics (code, copilot).
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, Microsoft; overlapping topics (code, copilot).
.NET built by Microsoft / Shared entities / Earlier coverage
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, July, Microsoft; earlier Copilot coverage from 2026-07-30.
Linked by a graph relationship (.NET built by Microsoft); both cover Copilot, July, Microsoft; earlier Copilot coverage from 2026-07-30.