CVE-2021-38649
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Published Sep 15, 2021 · updated Aug 10, 2026 · microsoft azure automation state configuration
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Timeline
Detection, updates, and resolution for this record.
Sep 15, 2021 · Catalog
Detected
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 10, 2026 · Catalog
Updated
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe microsoft/azure automation state configurationversion unspecified
- cpe microsoft/azure automation update managementversion unspecified
- cpe microsoft/azure diagnostics (lad)version unspecified
- cpe microsoft/azure open management infrastructureversion unspecified
- cpe microsoft/azure security centerversion unspecified
- cpe microsoft/azure sentinelversion unspecified
- cpe microsoft/azure stack hubversion unspecified
- cpe microsoft/container monitoring solutionversion unspecified
- vendor Microsoft Open Management Infrastructure (OMI)version unspecified
Sources
- CISA KEVCVE-2021-38649
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
cisa.gov - CVE.orgCVE-2021-38649
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-38649
30-day exploitation probability 2.9%
first.org - NIST NVDCVE-2021-38649
Open Management Infrastructure Elevation of Privilege Vulnerability
nvd.nist.gov