Loading story…
Researchers disclosed OMIGOD, a set of four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI), a management service broadly deployed on Azure Linux virtual machines. The most severe issue, CVE-2021-38647, allows unauthenticated remote code execution via a crafted HTTP request, enabling attackers to run commands as the OMI agent user, which is commonly root on affected systems.
The flaws affect OMI versions earlier than 1.6.8-1, putting large numbers of Azure customers at risk where the service is exposed. Public proof-of-concept material and a Docker-based demo environment were released to help defenders validate exposure and generate indicators of compromise, while remediation guidance calls for upgrading to 1.6.8-1 or later.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Wiz Research Team published research describing four vulnerabilities in Open Management Infrastructure (OMI), including CVE-2021-38647, and said they were easy to exploit. The flaws could enable arbitrary remote code execution and privilege escalation to root on affected Azure Linux systems using OMI.
A GitHub project published a reproducible Docker-based lab and proof of concept for CVE-2021-38647 to help defenders validate exposure and generate indicators of compromise. The project demonstrates command execution and a reverse shell as root against a vulnerable OMI target.
A patched OMI release was made available to remediate the disclosed vulnerabilities, with the content stating that versions below 1.6.8-1 are vulnerable. Defenders are advised to upgrade to OMI version 1.6.8.1 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched **CVE-2022-29149**, a CVSS 7.8 local privilege-escalation vulnerability in Open Management Infrastructure (OMI) versions earlier than `1.6.9-1`. OMI, Linux/UNIX management middleware that can be installed through Azure monitoring and management agents, used a predictable time-based seed in its `secretString` authentication mechanism. A low-privileged local attacker could reconstruct the secret, forge privileged internal messages, and obtain root access, with high confidentiality, integrity, and availability impact. Microsoft directed customers to update affected OMI installations and dependent Azure and System Center components, including agents, VM extensions, management packs, container images, and Azure Stack Hub extensions. Following researcher coordination, Microsoft expanded customer notifications and added Automatic Extension Upgrade support for OMS, Linux Azure Diagnostics, and Desired State Configuration agents; enabling it automatically updates bundled OMI. Organizations should inventory potentially silently deployed cloud-management agents, enable automatic extension upgrades where available, manually remediate unsupported deployments, and migrate to Azure Monitor Agent where feasible because it does not rely on OMI.
Sep 3, 2026
Microsoft disclosed and patched multiple elevation-of-privilege vulnerabilities affecting Azure agent components, including **Azure Monitor Agent**, the **Azure Monitor Agent Metrics Extension**, the **Azure Connected Machine Agent**, and the **Azure Network Watcher VM Extension**. The newly detailed issues include `CVE-2026-32204`, an **Important** flaw in Azure Monitor Agent caused by external control of file name or path (`CWE-73`), and `CVE-2026-42830`, an **Important** untrusted search path vulnerability (`CWE-426`) in the Metrics Extension. Microsoft said both flaws could be exploited locally by low-privileged attackers to gain elevated privileges, with `CVE-2026-32204` potentially enabling file writes and unauthorized code execution as **root**, while `CVE-2026-42830` could lead to privilege escalation and arbitrary code execution through implicit loading behavior tied to OpenSSL configuration handling. The disclosures add to a broader pattern of privilege-escalation fixes across Azure management tooling, following earlier advisories for `CVE-2024-35254` in Azure Monitor Agent, `CVE-2023-35624` in Azure Connected Machine Agent, and `CVE-2025-21188` in the Azure Network Watcher VM Extension. Microsoft assigned a CVSS 3.1 score of **7.8** to `CVE-2026-32204` and **6.5** to `CVE-2026-42830`, said neither issue was publicly disclosed or exploited at the time of publication, and released official fixes. Microsoft credited **Cristhian Parrot of Kroll** for reporting `CVE-2026-42830` through coordinated vulnerability disclosure.
Jun 29, 2026
SentinelLabs disclosed multiple critical vulnerabilities in **Microsoft Azure Defender for IoT** that affected both cloud-connected and on-premises deployments and could allow attackers to compromise appliances without authentication. The issues included weaknesses in the password recovery workflow, such as a time-of-check/time-of-use race condition and logic flaws in certificate and subscription validation, tracked in part as `CVE-2021-42310`, which could let an attacker reset privileged passwords and take over administrative accounts. The report also detailed a command injection flaw that could lead to **root remote code execution** after account takeover (`CVE-2021-42312`), unauthenticated SQL injection bugs in token-related endpoints that could expose session IDs and enable further compromise (`CVE-2021-42313` and `CVE-2021-42311`), and a heap-based buffer overflow in the `RCDCAP` traffic-processing component (`CVE-2021-37222`). Microsoft issued security updates and advisories after responsible disclosure, and SentinelLabs said it had not observed active exploitation in the wild at the time of publication.
Aug 14, 2026