Microsoft warns thousands of cloud customers that a now-fixed Azure Cosmos vulnerability might have exposed databases, but it saw no evidence it was exploited
Microsoft (MSFT.O) on Thursday warned thousands of its cloud computing customers, including some of the world's largest companies …
ReutersJoseph Menn
Context & Ripple Effects
The immediate issue is a repair-and-notification test for Azure Cosmos: Microsoft says the flaw is fixed and reports no evidence of exploitation, but thousands of customers must still assess whether databases were exposed.
Related coverage shows this was not an isolated security-management concern: Microsoft later fixed another Azure access flaw reported by Palo Alto Networks, while a 2023 Azure issue drew public criticism from Tenable's CEO after the company criticized Microsoft's handling.
First-order effects
Microsoft must support notified Azure Cosmos customers with the information needed to assess possible database exposure, despite finding no evidence of misuse.
Azure Cosmos customers face an immediate security-review burden around databases that may have been reachable before Microsoft deployed the fix.
Second-order effects
The disclosure gives large cloud buyers a concrete reason to press Microsoft for clearer evidence of what a flaw exposed, how long it persisted, and what the fix changed.
Recurring Azure flaw reports, including the later Wiz-reported CosmosDB vulnerability, increase the reputational cost to Microsoft when vulnerability communications cannot quickly resolve customer-impact questions.
Third-order effects
If repeated Azure disclosures continue, enterprise cloud procurement is likely to put more weight on auditable incident reporting and verifiable remediation, not only a provider's assertion that no customer impact was found.
Security researchers' role in surfacing Azure flaws points toward a cloud-security market in which independent findings increasingly shape hyperscaler accountability.
The trend: Hyperscaler security is shifting toward proof-oriented customer assurance, as vulnerability fixes alone do not settle questions about exposure and impact.
“The disclosure comes after months of bad security news for Microsoft. The company was breached by the same suspected Russian government hackers that infiltrated SolarWinds, who stole @Microsoft source code here.” https://www.reuters.com/...
Microsoft warned clients that intruders could have the ability to read, change or even delete their main databases, according to a copy of the email and a cyber security researcher. The vulnerability is in Microsoft Azure's flagship Cosmos database. https://www.reuters.com/...
Cloud security is an illusion. Transferring the risks doesn't make them disappear. At best you'll lose visibility and sleep better (but really, you shouldn't). https://twitter.com/...
“This is the worst cloud vulnerability you can imagine. It is a long-lasting secret,” Luttwak told Reuters. “This is the central database of Azure, and we were able to get access to any customer database that we wanted.” https://twitter.com/...
“The vulnerability is in Microsoft Azure's flagship Cosmos DB database. A research team at security company Wiz discovered it was able to access keys that control access to databases held by thousands of companies. Oh my. 😬 https://twitter.com/...
Man. With everything going on lately it's almost like Microsoft could use some sort of security initiative for Azure. Like, something trustworthy. In unrelated news, former employees disclosing vulns in their area of expertise probably have good lawyers? https://www.reuters.com/.…
#BREAKING. Exclusive: Microsoft warns thousands of its cloud computing customers, including some of the world's largest companies, of exposed databases https://www.reuters.com/...
Problems with Azure are especially troubling, because Microsoft and outside security experts have been pushing companies to abandon most of their own infrastructure and rely on the cloud for more security https://www.livemint.com/...