Microsoft System Center Operations Manager vulnerabilities

17 CVEs affecting Microsoft System Center Operations Manager, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20967, published 2026-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-38647: Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability, published 2021-09-15. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVE-2021-38648: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 11.4% chance of exploitation in the next 30 days. Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2021-38649: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability, published 2021-09-15. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 2.9% chance of exploitation in the next 30 days. Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2021-38645: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 2.7% chance of exploitation in the next 30 days. Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2024-21334, published 2024-03-12. Critical severity, CVSS 9.8. EPSS: 20.2% chance of exploitation in the next 30 days. Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVE-2013-0010, published 2013-01-09. Medium severity, CVSS 4.3. EPSS: 16.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System…
CVE-2013-0009, published 2013-01-09. Medium severity, CVSS 4.3. EPSS: 13.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System…
CVE-2015-2420, published 2015-08-15. Medium severity, CVSS 4.3. EPSS: 8.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject…
CVE-2021-41352, published 2021-10-13. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. SCOM Information Disclosure Vulnerability
CVE-2021-1728, published 2021-02-25. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. System Center Operations Manager Elevation of Privilege Vulnerability

Latest

CVE-2026-20967, published 2026-03-10. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
CVE-2025-27743, published 2025-04-08. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
CVE-2024-21330, published 2024-03-12. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVE-2023-36043, published 2023-11-14. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Open Management Infrastructure Information Disclosure Vulnerability
CVE-2022-33640, published 2022-08-09. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVE-2022-29149, published 2022-06-15. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability