CVE-2021-38649: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 2.9% chance of exploitation in the next 30 days.

Open Management Infrastructure Elevation of Privilege Vulnerability

Affected products

• Microsoft Azure Automation State Configuration: affected versions not specified
• Microsoft Azure Automation Update Management: affected versions not specified
• Microsoft Azure Diagnostics (lad): affected versions not specified
• Microsoft Azure Open Management Infrastructure: affected versions not specified
• Microsoft Azure Security Center: affected versions not specified
• Microsoft Azure Sentinel: affected versions not specified
• Microsoft Azure Stack Hub: affected versions not specified
• Microsoft Container Monitoring Solution: affected versions not specified
• Microsoft Log Analytics Agent: affected versions not specified
• Microsoft Open Management Infrastructure: before 1.6.8-1 (fixed in 1.6.8-1)
• Microsoft System Center Operations Manager: affected versions not specified

Published 2021-09-15. Last modified 2026-08-10.