#cloud

Analysis · May 20, 2026 · Colten Anderson

OMIGOD: an unauth root RCE in an agent you didn't know Azure installed

CVE-2021-38647 is an unauthenticated remote code execution as root in the OMI agent. Most victims didn't know they were running OMI, Azure silently deployed it on Linux VMs when you enabled common services. Invisible agents are invisible attack surface.