Listen to this Post
How CVE-2026-66803 Works
CVE-2026-66803 is a critical improper access control vulnerability in Microsoft Azure Cosmos DB that allows an unauthenticated remote attacker to execute arbitrary code over a network. The vulnerability, dubbed “CosmosEscape” by the researchers who discovered it, is a sandbox escape flaw within the Azure Cosmos DB Gremlin API.
The Gremlin API is one of several query languages supported by Cosmos DB. Microsoft built a custom Gremlin engine that compiles queries into executable code. The security restrictions implemented in this engine did not sufficiently account for .NET reflection, which allowed researchers to achieve code execution by submitting crafted queries against their own database.
This initial code execution placed the attacker on the DB Gateway—the multi-tenant service responsible for running customer queries. The DB Gateway accesses databases using the account’s primary key, and the researchers discovered that the gateway obtained these keys through a signing key accessible via credentials stored on the cluster. Critically, this signing key was not scoped to a single account—it worked across tenants, regions, and every Cosmos DB API flavor.
With this “Cosmos Master Key,” an attacker could retrieve the primary key for any account on the service through publicly accessible endpoints. The same key also unlocked the Config Store, a regional registry containing every Cosmos DB account with names, subscription IDs, tenant IDs, and network settings—itself a Cosmos DB database that could be queried to identify specific organizations’ databases before compromising them.
The vulnerability chain effectively provided full read and write access to every database on the service, including Microsoft’s own internal infrastructure such as Entra ID, Teams, and Copilot. The exploit bypassed network isolation and private link protections because the compromised gateway was the component responsible for enforcing these security boundaries. Microsoft took approximately eight months to complete the architectural fix, with the vulnerability reported on November 20, 2025, and the final remediation reaching all regions by July 2026.
DailyCVE Form:
Platform: Azure Cosmos DB
Version: All versions (Gremlin API)
Vulnerability: Improper Access Control
Severity: CRITICAL (10.0 CVSS)
Date: July 30, 2026
Prediction: Already Patched (July 2026)
What Undercode Say: Analytics
Vulnerability Metrics:
CVSS Score: 10.0 (CRITICAL) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: CWE-284 (Improper Access Control) EPSS Score: 0.49% (probability of exploitation in next 30 days) EPSS Percentile: Higher than 40% of all CVEs
Key Technical Indicators:
Attack Vector: Network (remote exploitation) Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed (impact beyond vulnerable component) Confidentiality Impact: High Integrity Impact: High Availability Impact: High
Timeline Analytics:
Reported to Microsoft: November 20, 2025 Hotfix Deployed: November 22, 2025 (48 hours) Architectural Fix Complete: July 2026 CVE Published: July 30, 2026 CVE Last Modified: August 4, 2026
How Exploit: CosmosEscape Attack Chain
Stage 1 – Sandbox Escape:
Attacker submits crafted Gremlin query exploiting .NET reflection Query against own Cosmos DB database with Gremlin API gremlin> // Malicious query leveraging .NET reflection gremlin> // to escape the Gremlin sandbox
Stage 2 – Gateway Compromise:
Code execution on DB Gateway cluster Attacker obtains privileged service credentials Access to signing key (Cosmos Master Key) stored on cluster Key works across all tenants, regions, and APIs
Stage 3 – Primary Key Theft:
Using Cosmos Master Key to generate primary access keys Publicly accessible endpoints used to retrieve keys Full read/write access to any Cosmos DB account
Stage 4 – Config Store Enumeration:
Query Config Store (Cosmos DB database) Enumerate account names, subscription IDs, tenant IDs Identify target organizations Generate primary keys for specific accounts
Stage 5 – Full Database Takeover:
Cross-tenant access to any Cosmos DB instance Unauthorized read and write access Access to Microsoft internal services (Entra ID, Teams, Copilot) Complete bypass of network isolation and private link protections
Protection: From This CVE
Immediate Actions:
- Apply Microsoft’s security patches immediately (refer to MSRC bulletin CVE-2026-66803)
- Rotate all primary account keys for Azure Cosmos DB instances
- Review Cosmos DB access logs for any unauthorized or suspicious activity
Long-term Mitigation:
- Transition applications from static primary keys to managed identities
- Implement role-based access control (RBAC) for Cosmos DB
- Enable Azure Monitor and Azure Security Center for continuous monitoring
- Implement network security groups and private endpoints where applicable
Detection Commands:
Review Azure Activity Log for unusual Cosmos DB operations az monitor activity-log list --query "[?contains(resourceId, 'Microsoft.DocumentDB')]" Check Cosmos DB diagnostic settings az monitor diagnostic-settings show --resource <cosmos-db-resource-id> Audit Cosmos DB key rotations az cosmosdb database list-keys --name <account-name> --resource-group <rg>
Impact
Scope: All Azure Cosmos DB accounts using the Gremlin API
Data Exposure: Primary account keys (full read/write access), subscription IDs, tenant IDs, regional configuration metadata, database account names and tags
Affected Microsoft Services: Entra ID, Teams, Copilot (all using Cosmos DB for backend storage)
Business Impact:
- Complete cross-tenant database takeover
- Full read and write access to all customer and internal databases
- Potential for data theft, modification, and deletion
- Bypass of network isolation and private link protections
Remediation Status: Microsoft fully remediated the issue and eliminated the Cosmos Master Key. Access log reviews found no unauthorized activity outside researcher testing and no customer data was accessed. No customer action is required beyond key rotation and adopting managed identities.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
