CVE-2024-21330: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-12 · updated 2026-06-17
Weakness: CWE-122

Description

Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

Affected products

Microsoft Azure Automation: all versions
Microsoft Azure Automation Update Management: all versions
Microsoft Azure Security Center: all versions
Microsoft Azure Sentinel: all versions
Microsoft Container Monitoring Solution: all versions
Microsoft Log Analytics Agent: all versions
Microsoft Operations Management Suite Agent For Linux: before 1.8.1-0 — fixed in 1.8.1-0
Microsoft System Center 2019 Operations Manager: 2019, 2022
Microsoft Azure Automation: from 1.0.0 before OMS Agent for Linux GA 1.19.0 — fixed in OMS Agent for Linux GA 1.19.0
Microsoft Azure Automation Update Management: from 1.0.0 before OMS Agent for Linux GA v1.19.0 — fixed in OMS Agent for Linux GA v1.19.0
Microsoft Azure HDInsight: from 1.0 before omi-1.8.1-0 — fixed in omi-1.8.1-0
Microsoft Azure Security Center: from 1.0.0 before OMS Agent for Linux GA 1.19.0 — fixed in OMS Agent for Linux GA 1.19.0
Microsoft Azure Sentinel: from 1.0.0 before OMS Agent for Linux GA v1.19.0 — fixed in OMS Agent for Linux GA v1.19.0
Microsoft Container Monitoring Solution: from 1.0.0 before microsoft-oms-latest with full ID: sha256:855bfeb0 — fixed in microsoft-oms-latest with full ID: sha256:855bfeb0
Microsoft Log Analytics Agent: from 1.0.0 before OMS Agent for Linux GA v1.19.0 — fixed in OMS Agent for Linux GA v1.19.0
Microsoft Open Management Infrastructure: from 16.0 before OMI version 1.8.1-0 — fixed in OMI version 1.8.1-0
Microsoft System Center Operations Manager (SCOM) 2019: from 10.19.0 before 10.19.1253.0 — fixed in 10.19.1253.0
Microsoft System Center Operations Manager (SCOM) 2022: from 10.22.0 before 10.22.1070.0 — fixed in 10.22.1070.0

How to fix

Upgrade to a fixed version: Microsoft Operations Management Suite Agent For Linux 1.8.1-0; Microsoft Azure Automation OMS Agent for Linux GA 1.19.0; Microsoft Azure Automation Update Management OMS Agent for Linux GA v1.19.0; Microsoft Azure HDInsight omi-1.8.1-0; Microsoft Azure Security Center OMS Agent for Linux GA 1.19.0; Microsoft Azure Sentinel OMS Agent for Linux GA v1.19.0; Microsoft Container Monitoring Solution microsoft-oms-latest with full ID: sha256:855bfeb0; Microsoft Log Analytics Agent OMS Agent for Linux GA v1.19.0; Microsoft Open Management Infrastructure OMI version 1.8.1-0; Microsoft System Center Operations Manager (SCOM) 2019 10.19.1253.0; Microsoft System Center Operations Manager (SCOM) 2022 10.22.1070.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21330 or the next vulnerability affects your stack