Wiz’s research team discovered a series of four vulnerabilities in the Open Management Infrastructure (OMI) software agent that is pre-installed in all Linux virtual machines in Microsoft’s cloud platform, Azure. Tracked as CVE-2021-3864, CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649, these vulnerabilities were dubbed “OMIGOD” because, the research team stated, “that was our reaction when we discovered them.” These vulnerabilities allow complete remote takeover of the root account by removing the authentication header in the malicious request. Following the discovery of these vulnerabilities, Microsoft patched OMI on September 14, 2021, but did not automatically update OMI on affected versions. As of September 17th, the OMIGOD vulnerabilities still exist on most new Azure Linux VMs and require manual updating on existing instances.