Loading story…
Microsoft patched CVE-2022-29149, a CVSS 7.8 local privilege-escalation vulnerability in Open Management Infrastructure (OMI) versions earlier than 1.6.9-1. OMI, Linux/UNIX management middleware that can be installed through Azure monitoring and management agents, used a predictable time-based seed in its secretString authentication mechanism. A low-privileged local attacker could reconstruct the secret, forge privileged internal messages, and obtain root access, with high confidentiality, integrity, and availability impact.
Microsoft directed customers to update affected OMI installations and dependent Azure and System Center components, including agents, VM extensions, management packs, container images, and Azure Stack Hub extensions. Following researcher coordination, Microsoft expanded customer notifications and added Automatic Extension Upgrade support for OMS, Linux Azure Diagnostics, and Desired State Configuration agents; enabling it automatically updates bundled OMI. Organizations should inventory potentially silently deployed cloud-management agents, enable automatic extension upgrades where available, manually remediate unsupported deployments, and migrate to Azure Monitor Agent where feasible because it does not rely on OMI.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced Automatic Extension Upgrade support for the Azure Desired State Configuration extension for Linux. The DSCForLinux extension installs OMI and the DSC agent, and Microsoft recommended enabling automatic upgrades to receive security and performance updates.
Azure updated the MSRC advisory with additional vulnerability, affected-service, and remediation details. Microsoft also sent Azure Service Health Notifications to affected customers.
Microsoft released a Patch Tuesday fix for CVE-2022-29149, a CVSS 7.8 local privilege-escalation vulnerability affecting OMI versions earlier than 1.6.9-1. The fix updated OMI to version 1.6.9-1 and removed the vulnerable secretString mechanism.
The OMIGOD findings affecting Azure OMI, including a root-level remote command-execution flaw, were published. The research stated there was evidence of exploitation in the wild, and Microsoft released patches while customers initially had to update installations themselves.
Wiz reported four vulnerabilities in Microsoft's Open Management Infrastructure (OMI), including CVE-2021-38645 and CVE-2021-38647.
Microsoft onboarded the OMS, Azure Diagnostics/LAD, and DSC agents to Azure Automatic Extension Upgrade, allowing enabled agents and their bundled OMI components to receive updates automatically.
Wiz developed and validated a proof of concept for CVE-2022-29149, showing that OMI's predictable time-seeded secretString could be recreated to forge privileged messages and obtain root privileges. Wiz shared its findings on vulnerable OMI prevalence and remediation challenges with Microsoft and Azure.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
wiz.io
Open sourcewiz.io
Open sourcetechcommunity.microsoft.com
Open sourcetechcommunity.microsoft.com
Open sourcewiz.io
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **OMIGOD**, a set of four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI), a management service broadly deployed on Azure Linux virtual machines. The most severe issue, `CVE-2021-38647`, allows **unauthenticated remote code execution** via a crafted HTTP request, enabling attackers to run commands as the OMI agent user, which is commonly **`root`** on affected systems. The flaws affect OMI versions earlier than **`1.6.8-1`**, putting large numbers of Azure customers at risk where the service is exposed. Public proof-of-concept material and a Docker-based demo environment were released to help defenders validate exposure and generate indicators of compromise, while remediation guidance calls for upgrading to **`1.6.8-1`** or later.
Aug 15, 2026
Microsoft disclosed and patched multiple elevation-of-privilege vulnerabilities affecting Azure agent components, including **Azure Monitor Agent**, the **Azure Monitor Agent Metrics Extension**, the **Azure Connected Machine Agent**, and the **Azure Network Watcher VM Extension**. The newly detailed issues include `CVE-2026-32204`, an **Important** flaw in Azure Monitor Agent caused by external control of file name or path (`CWE-73`), and `CVE-2026-42830`, an **Important** untrusted search path vulnerability (`CWE-426`) in the Metrics Extension. Microsoft said both flaws could be exploited locally by low-privileged attackers to gain elevated privileges, with `CVE-2026-32204` potentially enabling file writes and unauthorized code execution as **root**, while `CVE-2026-42830` could lead to privilege escalation and arbitrary code execution through implicit loading behavior tied to OpenSSL configuration handling. The disclosures add to a broader pattern of privilege-escalation fixes across Azure management tooling, following earlier advisories for `CVE-2024-35254` in Azure Monitor Agent, `CVE-2023-35624` in Azure Connected Machine Agent, and `CVE-2025-21188` in the Azure Network Watcher VM Extension. Microsoft assigned a CVSS 3.1 score of **7.8** to `CVE-2026-32204` and **6.5** to `CVE-2026-42830`, said neither issue was publicly disclosed or exploited at the time of publication, and released official fixes. Microsoft credited **Cristhian Parrot of Kroll** for reporting `CVE-2026-42830` through coordinated vulnerability disclosure.
Jun 29, 2026
Multiple vendors issued fixes for **high-impact vulnerabilities** that could enable privilege escalation, tenant-wide compromise, security feature bypass, or remote code execution. OpenStack patched **CVE-2026-22797** in *keystonemiddleware* affecting deployments using `external_oauth2_token`, where failure to sanitize incoming identity headers allows authenticated users to forge headers (e.g., `X-Is-Admin-Project`, `X-Roles`, `X-User-Id`) to **escalate privileges or impersonate other users**; fixes were released across supported branches and the issue was reported by a Red Hat researcher. Microsoft patched **CVE-2026-20965** in *Windows Admin Center*’s Azure SSO (fixed in Azure Extension **v0.70.00**), where improper token validation could let an attacker with local admin on a WAC-enabled Azure VM/Arc machine combine a stolen `WAC.CheckAccess` token with a forged PoP token to enable **lateral movement and tenant-wide access** under certain conditions. Separately, Microsoft addressed **CVE-2026-20824** in *Windows Remote Assistance*, an **Important** security feature bypass that can allow attackers to evade **Mark of the Web (MOTW)** protections via social engineering. Progress Software also released patches for **CVE-2025-13444** and **CVE-2025-13447** (CVSS 8.4) affecting *LoadMaster* and *MOVEit WAF*, where crafted UI/API requests can trigger **command injection leading to remote code execution**; the vendor stated it had no evidence of in-the-wild exploitation at the time of release.
Jun 29, 2026