CVE-2021-38645
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Published Sep 15, 2021 · updated Aug 10, 2026 · microsoft azure automation state configuration
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Timeline
Detection, updates, and resolution for this record.
Sep 15, 2021 · Catalog
Detected
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 10, 2026 · Catalog
Updated
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe microsoft/azure automation state configurationversion unspecified
- cpe microsoft/azure automation update managementversion unspecified
- cpe microsoft/azure diagnostics (lad)version unspecified
- cpe microsoft/azure security centerversion unspecified
- cpe microsoft/azure sentinelversion unspecified
- cpe microsoft/azure stack hubversion unspecified
- cpe microsoft/container monitoring solutionversion unspecified
- cpe microsoft/log analytics agentversion unspecified
- vendor Microsoft Open Management Infrastructure (OMI)version unspecified
Sources
- CISA KEVCVE-2021-38645
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
cisa.gov - CVE.orgCVE-2021-38645
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-38645
30-day exploitation probability 2.7%
first.org - NIST NVDCVE-2021-38645
Open Management Infrastructure Elevation of Privilege Vulnerability
nvd.nist.gov