Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Priority CRITICAL 100Exploited in the wildPublished · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2021-11-17Known ransomware use
EPSS 0.99933 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Azure Automation State Configuration, DSC Extension (Microsoft): DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3Azure Automation Update Management (Microsoft): OMS Agent for Linux GA v1.13.40-0+8 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Azure Automation State Configuration, DSC Extension | 2.0.0 to before DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 | DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 | Patch available | CNA |
| Microsoft | Azure Automation Update Management | 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 | OMS Agent for Linux GA v1.13.40-0 | Patch available | CNA |
| Microsoft | Azure Diagnostics (LAD) | 3.0.0 to before LAD v4.0.13 and LAD v3.0.135 | LAD v4.0.13 and LAD v3.0.135 | Patch available | CNA |
| Microsoft | Azure Security Center | 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 | OMS Agent for Linux GA v1.13.40-0 | Patch available | CNA |
| Microsoft | Azure Sentinel | 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 | OMS Agent for Linux GA v1.13.40-0 | Patch available | CNA |
| Microsoft | Azure Stack Hub | 1.0.0 to before Monitor, Update and Config Mgmnt 1.14.01 | Monitor, Update and Config Mgmnt 1.14.01 | Patch available | CNA |
| Microsoft | Container Monitoring Solution | 1.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Log Analytics Agent | 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 | OMS Agent for Linux GA v1.13.40-0 | Patch available | CNA |
| Microsoft | Open Management Infrastructure | 16.0 to before OMI Version 1.6.8-1 | OMI Version 1.6.8-1 | Patch available | CNA |
| Microsoft | System Center Operations Manager (SCOM) | 1.0.0 to before OMI version: 1.6.8-1 | OMI version: 1.6.8-1 | Patch available | CNA |
- Azure Automation State Configuration, DSC Extension VendorMicrosoft Affected 2.0.0 to before DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 Fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 Patch available CNA
- Azure Automation Update Management VendorMicrosoft Affected 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 Fixed in OMS Agent for Linux GA v1.13.40-0 Patch available CNA
- Azure Diagnostics (LAD) VendorMicrosoft Affected 3.0.0 to before LAD v4.0.13 and LAD v3.0.135 Fixed in LAD v4.0.13 and LAD v3.0.135 Patch available CNA
- Azure Security Center VendorMicrosoft Affected 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 Fixed in OMS Agent for Linux GA v1.13.40-0 Patch available CNA
- Azure Sentinel VendorMicrosoft Affected 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 Fixed in OMS Agent for Linux GA v1.13.40-0 Patch available CNA
- Azure Stack Hub VendorMicrosoft Affected 1.0.0 to before Monitor, Update and Config Mgmnt 1.14.01 Fixed in Monitor, Update and Config Mgmnt 1.14.01 Patch available CNA
- Container Monitoring Solution VendorMicrosoft Affected 1.0.0 to before publication Fixed in publication Patch available CNA
- Log Analytics Agent VendorMicrosoft Affected 1.0.0 to before OMS Agent for Linux GA v1.13.40-0 Fixed in OMS Agent for Linux GA v1.13.40-0 Patch available CNA
- Open Management Infrastructure VendorMicrosoft Affected 16.0 to before OMI Version 1.6.8-1 Fixed in OMI Version 1.6.8-1 Patch available CNA
- System Center Operations Manager (SCOM) VendorMicrosoft Affected 1.0.0 to before OMI version: 1.6.8-1 Fixed in OMI version: 1.6.8-1 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* | before 1.6.8-1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:* Versions before 1.6.8-1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Remediation
- Fix · CNA Azure Automation State Configuration, DSC Extension (Microsoft) Fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3
- Fix · CNA Azure Automation Update Management (Microsoft) Fixed in OMS Agent for Linux GA v1.13.40-0
- Fix · CNA Azure Diagnostics (LAD) (Microsoft) Fixed in LAD v4.0.13 and LAD v3.0.135
- Fix · CNA Azure Security Center (Microsoft) Fixed in OMS Agent for Linux GA v1.13.40-0
- Fix · CNA Azure Sentinel (Microsoft) Fixed in OMS Agent for Linux GA v1.13.40-0
- Fix · CNA Azure Stack Hub (Microsoft) Fixed in Monitor, Update and Config Mgmnt 1.14.01
- Fix · CNA Container Monitoring Solution (Microsoft) Fixed in publication
- Fix · CNA Log Analytics Agent (Microsoft) Fixed in OMS Agent for Linux GA v1.13.40-0
- Fix · CNA Open Management Infrastructure (Microsoft) Fixed in OMI Version 1.6.8-1
- Fix · CNA System Center Operations Manager (SCOM) (Microsoft) Fixed in OMI version: 1.6.8-1
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-38647
- 2026-10-03 Alias added: GHSA-rp2g-5hw2-q565
References
More Microsoft Azure Automation State Configuration vulnerabilities
- TI-2021-16226 Open Management Infrastructure Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2021-16225 Open Management Infrastructure Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2021-16222 Open Management Infrastructure Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2022-11694 Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.8
Sources
- CVE-2021-38647 · CVE Program
- CVE-2021-38647 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-rp2g-5hw2-q565 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences