What’s Vulnerable › Vulnerabilities

CVE-2021-38648: Open Management Infrastructure Elevation of Privilege Vulnerability

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 11.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-15 · updated 2026-08-10

Description

Open Management Infrastructure Elevation of Privilege Vulnerability

Affected products

• Microsoft Azure Automation State Configuration: all versions
• Microsoft Azure Automation Update Management: all versions
• Microsoft Azure Diagnostics (Lad): all versions
• Microsoft Azure Open Management Infrastructure: all versions
• Microsoft Azure Security Center: all versions
• Microsoft Azure Sentinel: all versions
• Microsoft Azure Stack Hub: all versions
• Microsoft Container Monitoring Solution: all versions
• Microsoft Log Analytics Agent: all versions
• Microsoft Open Management Infrastructure: before 1.6.8-1 — fixed in 1.6.8-1
• Microsoft System Center 2019 Operations Manager: all versions
• Microsoft Azure Automation State Configuration, DSC Extension: from 2.0.0 before DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 — fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3
• Microsoft Azure Automation Update Management: from 1.0.0 before OMS Agent for Linux GA v1.13.40-0 — fixed in OMS Agent for Linux GA v1.13.40-0
• Microsoft Azure Diagnostics (LAD): from 3.0.0 before LAD v4.0.13 and LAD v3.0.135 — fixed in LAD v4.0.13 and LAD v3.0.135
• Microsoft Azure Security Center: from 1.0.0 before OMS Agent for Linux GA v1.13.40-0 — fixed in OMS Agent for Linux GA v1.13.40-0
• Microsoft Azure Sentinel: from 1.0.0 before OMS Agent for Linux GA v1.13.40-0 — fixed in OMS Agent for Linux GA v1.13.40-0
• Microsoft Azure Stack Hub: from 1.0.0 before Monitor, Update and Config Mgmnt 1.14.01 — fixed in Monitor, Update and Config Mgmnt 1.14.01
• Microsoft Container Monitoring Solution: from 1.0.0 before publication — fixed in publication
• Microsoft Log Analytics Agent: from 1.0.0 before OMS Agent for Linux GA v1.13.40-0 — fixed in OMS Agent for Linux GA v1.13.40-0
• Microsoft Open Management Infrastructure: from 16.0 before OMI Version 1.6.8-1 — fixed in OMI Version 1.6.8-1
• Microsoft System Center Operations Manager (SCOM): from 1.0.0 before OMI version: 1.6.8-1 — fixed in OMI version: 1.6.8-1

How to fix

Upgrade to a fixed version: Microsoft Open Management Infrastructure 1.6.8-1; Microsoft Azure Automation State Configuration, DSC Extension DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3; Microsoft Azure Automation Update Management OMS Agent for Linux GA v1.13.40-0; Microsoft Azure Diagnostics (LAD) LAD v4.0.13 and LAD v3.0.135; Microsoft Azure Security Center OMS Agent for Linux GA v1.13.40-0; Microsoft Azure Sentinel OMS Agent for Linux GA v1.13.40-0; Microsoft Azure Stack Hub Monitor, Update and Config Mgmnt 1.14.01; Microsoft Container Monitoring Solution publication; Microsoft Log Analytics Agent OMS Agent for Linux GA v1.13.40-0; Microsoft Open Management Infrastructure OMI Version 1.6.8-1; Microsoft System Center Operations Manager (SCOM) OMI version: 1.6.8-1. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648
• http://packetstormsecurity.com/files/164925/Microsoft-OMI-Management-Interface-Authentication-Bypass.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38648
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38648

Get alerted when CVE-2021-38648 or the next vulnerability affects your stack