OMIGOD is the name for four vulnerabilities that Wiz Research found in OMI, a software agent installed by default on Microsoft Azure Linux virtual machines. CVE-2021-38647 allows unauthenticated remote code execution as root. CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649 are privilege escalation flaws. Microsoft released the fix, OMI version 1.6.8-1, on September 8, 2021.
Updated
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2021-38647KEV Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Microsoft | 9.8 | 99.9% | KEV | 2021-09-15 |
| CVE-2021-38648KEV Open Management Infrastructure Elevation of Privilege Vulnerability | Open Management Infrastructure Elevation of Privilege Vulnerability | Microsoft | 7.8 | 11.4% | KEV | 2021-09-15 |
| CVE-2021-38649KEV Open Management Infrastructure Elevation of Privilege Vulnerability | Open Management Infrastructure Elevation of Privilege Vulnerability | Microsoft | 7.0 | 2.9% | KEV | 2021-09-15 |
| CVE-2021-38645KEV Open Management Infrastructure Elevation of Privilege Vulnerability | Open Management Infrastructure Elevation of Privilege Vulnerability | Microsoft | 7.8 | 2.7% | KEV | 2021-09-15 |
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Part of OMIGOD, four flaws that Wiz researchers found in OMI, an agent deployed on many Azure Linux virtual machines; this CVE is the unauthenticated remote code execution flaw that runs code as root. Tenable rates it the most severe of the four, and Microsoft released the fixed OMI version 1.6.8-1 on September 8, 2021.
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Part of OMIGOD, four flaws that Wiz researchers found in OMI, an agent deployed on many Azure Linux virtual machines; this CVE is a local privilege escalation flaw. Wiz describes it as remarkably similar to the remote code execution flaw CVE-2021-38647 and says it affects all OMI installations before version 1.6.8-1.
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Part of OMIGOD, four flaws that Wiz researchers found in OMI, an agent deployed on many Azure Linux virtual machines; this CVE is one of the three privilege escalation flaws. Microsoft released the fixed OMI version 1.6.8-1 on September 8, 2021.
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Part of OMIGOD, four flaws that Wiz researchers found in OMI, an agent deployed on many Azure Linux virtual machines; this CVE is one of the three privilege escalation flaws. Microsoft released the fixed OMI version 1.6.8-1 on September 8, 2021.
| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2021-38647 | 2021-11-03 | 2021-11-17 | Known use |
| CVE-2021-38648 | 2021-11-03 | 2021-11-17 | - |
| CVE-2021-38645 | 2021-11-03 | 2021-11-17 | - |
| CVE-2021-38649 | 2021-11-03 | 2021-11-17 | - |
| CVE | Vendor | Product | Versions |
|---|---|---|---|
| CVE-2021-38647 | Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 to <DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| CVE-2021-38647 | Microsoft | Azure Automation Update Management | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38647 | Microsoft | Azure Diagnostics (LAD) | 3.0.0 to <LAD v4.0.13 and LAD v3.0.135 |
| CVE-2021-38647 | Microsoft | Azure Security Center | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38647 | Microsoft | Azure Sentinel | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38647 | Microsoft | Azure Stack Hub | 1.0.0 to <Monitor, Update and Config Mgmnt 1.14.01 |
| CVE-2021-38647 | Microsoft | Container Monitoring Solution | 1.0.0 to <publication |
| CVE-2021-38647 | Microsoft | Log Analytics Agent | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38647 | Microsoft | Open Management Infrastructure | 16.0 to <OMI Version 1.6.8-1 |
| CVE-2021-38647 | Microsoft | System Center Operations Manager (SCOM) | 1.0.0 to <OMI version: 1.6.8-1 |
| CVE-2021-38648 | Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 to <DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| CVE-2021-38648 | Microsoft | Azure Automation Update Management | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38648 | Microsoft | Azure Diagnostics (LAD) | 3.0.0 to <LAD v4.0.13 and LAD v3.0.135 |
| CVE-2021-38648 | Microsoft | Azure Security Center | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38648 | Microsoft | Azure Sentinel | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38648 | Microsoft | Azure Stack Hub | 1.0.0 to <Monitor, Update and Config Mgmnt 1.14.01 |
| CVE-2021-38648 | Microsoft | Container Monitoring Solution | 1.0.0 to <publication |
| CVE-2021-38648 | Microsoft | Log Analytics Agent | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38648 | Microsoft | Open Management Infrastructure | 16.0 to <OMI Version 1.6.8-1 |
| CVE-2021-38648 | Microsoft | System Center Operations Manager (SCOM) | 1.0.0 to <OMI version: 1.6.8-1 |
| CVE-2021-38645 | Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 to <DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| CVE-2021-38645 | Microsoft | Azure Automation Update Management | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38645 | Microsoft | Azure Diagnostics (LAD) | 3.0.0 to <LAD v4.0.13 and LAD v3.0.135 |
| CVE-2021-38645 | Microsoft | Azure Security Center | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38645 | Microsoft | Azure Sentinel | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38645 | Microsoft | Azure Stack Hub | 1.0.0 to <Monitor, Update and Config Mgmnt 1.14.01 |
| CVE-2021-38645 | Microsoft | Container Monitoring Solution | 1.0.0 to <publication |
| CVE-2021-38645 | Microsoft | Log Analytics Agent | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38645 | Microsoft | Open Management Infrastructure | 16.0 to <OMI Version 1.6.8-1 |
| CVE-2021-38645 | Microsoft | System Center Operations Manager (SCOM) | 1.0.0 to <OMI version: 1.6.8-1 |
| CVE-2021-38649 | Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 to <DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 |
| CVE-2021-38649 | Microsoft | Azure Automation Update Management | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38649 | Microsoft | Azure Diagnostics (LAD) | 3.0.0 to <LAD v4.0.13 and LAD v3.0.135 |
| CVE-2021-38649 | Microsoft | Azure Security Center | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38649 | Microsoft | Azure Sentinel | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38649 | Microsoft | Azure Stack Hub | 1.0.0 to <Monitor, Update and Config Mgmnt 1.14.01 |
| CVE-2021-38649 | Microsoft | Container Monitoring Solution | 1.0.0 to <publication |
| CVE-2021-38649 | Microsoft | Log Analytics Agent | 1.0.0 to <OMS Agent for Linux GA v1.13.40-0 |
| CVE-2021-38649 | Microsoft | Open Management Infrastructure | 16.0 to <OMI Version 1.6.8-1 |
| CVE-2021-38649 | Microsoft | System Center Operations Manager (SCOM) | 1.0.0 to <OMI version: 1.6.8-1 |
OMIGOD is the name for four vulnerabilities that Wiz Research found in OMI, a software agent installed by default on Microsoft Azure Linux virtual machines. CVE-2021-38647 allows unauthenticated remote code execution as root. CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649 are privilege escalation flaws. Microsoft released the fix, OMI version 1.6.8-1, on September 8, 2021.
OMIGOD covers four CVEs: CVE-2021-38647, CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649.
4 of the 4 OMIGOD CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2021-38647 (added 2021-11-03), CVE-2021-38648 (added 2021-11-03), CVE-2021-38645 (added 2021-11-03), and CVE-2021-38649 (added 2021-11-03).
The highest CVSS base score among the OMIGOD CVEs is 9.8 (CRITICAL), for CVE-2021-38647.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.