Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

TACTICThreat Analysis & Cyber Threat Intelligence Center
System themeFrançais

Back to the watch

CVE-2021-38648

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

UrgentCVSS 7.8 v3.1Exploited

Why this priority

?

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

  • Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.

Affected products

VendorProductVersions
MicrosoftAzure Automation State Configuration, DSC Extension
  • from 2.0.0 to DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 excluded
MicrosoftAzure Automation Update Management
  • from 1.0.0 to OMS Agent for Linux GA v1.13.40-0 excluded
MicrosoftAzure Diagnostics (LAD)
  • from 3.0.0 to LAD v4.0.13 and LAD v3.0.135 excluded
MicrosoftAzure Security Center
  • from 1.0.0 to OMS Agent for Linux GA v1.13.40-0 excluded
MicrosoftAzure Sentinel
  • from 1.0.0 to OMS Agent for Linux GA v1.13.40-0 excluded
MicrosoftAzure Stack Hub
  • from 1.0.0 to Monitor, Update and Config Mgmnt 1.14.01 excluded
MicrosoftContainer Monitoring Solution
  • from 1.0.0 to publication excluded
MicrosoftLog Analytics Agent
  • from 1.0.0 to OMS Agent for Linux GA v1.13.40-0 excluded
MicrosoftOpen Management Infrastructure (OMI)All versions
MicrosoftOpen Management Infrastructure
  • from 16.0 to OMI Version 1.6.8-1 excluded
MicrosoftSystem Center Operations Manager (SCOM)
  • from 1.0.0 to OMI version: 1.6.8-1 excluded

Revision history

  1. Revision 3

  2. Revision 2

    Update : Affected versions changed

  3. Revision 1

    New record

Qualification

CVSS severity
?

Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary

7.8 HIGH CVSS v3.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
KEV catalog
?

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary

Listed
Exploitation
Confirmed
EPSS probability
?

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary

Unknown
Confidence
?

Quality of the sources behind the record. It is not a risk score. See the glossary

High

Priority rules, version 1

CISA KEV catalog

Added on
3 November 2021
Federal due date
17 November 2021
Required action
Apply updates per vendor instructions.
Ransomware use
Unknown

Record

Published on
15 September 2021
Weaknesses (CWE)
CWE-1390

Sources

References

CVE-2021-38648 Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability · Avanguard TACTIC