Microsoft has made no public statement about the issue though Wiz notified the software behemoth about the flaw on 12 August after having discovered it three days earlier.

Wiz issued a blog post about the vulnerability which it made public soon after Reuters had reported about it, with the news agency finding out about the snafu through emails sent to customers.

The vulnerability allows outsiders to access keys that control entry to databases that are held by thousands of customers. The keys can only be changed by the customers.

In the post, Wiz's Nir Ohfeld and Sago Tzadik said big companies like Coca-Cola, Exxon-Mobile and Citrix used Cosmos DB to manage gigabytes of data in real-time.

I'm excited to share information about our research, in which we (+@nirohfeld) found a critical vulnerability in Azure Cosmos DB itself – effectively allowing malicious actors to fully compromise databases of thousands of customers. @wiz_io #ChaosDB https://t.co/gWli3fDRQI

— sagitz (@sagitz_) August 26, 2021

"As one of the simplest and most flexible ways for developers to store data, it powers critical business functions like processing millions of prescription transactions or managing customer order flows on e-commerce sites," the duo wrote, adding that exploiting the flaw was trivial.

They said while database exposures had quite common with the migration to the cloud, these leaks were usually caused by misconfigurations in the customer’s environment.

"In this case, customers were not at fault," Ohfeld and Tzadik wrote. "Rather, a series of flaws in a Cosmos DB feature created a loophole allowing any user to download, delete or manipulate a massive collection of commercial databases, as well as read/write access to the underlying architecture of Cosmos DB."

They said while Microsoft had acted swiftly after being notified, "customers may still be impacted since their primary access keys were potentially exposed".

"These are long-lived secrets and in the event of a breach, an attacker could use the key to exfiltrate databases," the pair noted. "Today [Thursday] Microsoft notified over 30% of Cosmos DB customers that they need to manually rotate their access keys to mitigate this exposure.

"Microsoft only emailed customers that were affected during our short (approximately week-long) research period. However, we believe many more Cosmos DB customers may be at risk. The vulnerability has been exploitable for at least several months, possibly years."