{"id":"CVE-2021-38647","state":"PUBLISHED","title":"Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","description":"Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","publishedAt":"2021-09-15T11:24:07.000Z","updatedAt":"2026-08-10T15:10:54.154Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Azure Automation State Configuration, DSC Extension","Microsoft Azure Automation Update Management","Microsoft Azure Diagnostics (LAD)","Microsoft Azure Security Center","Microsoft Azure Sentinel","Microsoft Azure Stack Hub","Microsoft Container Monitoring Solution","Microsoft Log Analytics Agent","Microsoft Open Management Infrastructure","Microsoft System Center Operations Manager (SCOM)"],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.13 and LAD v3.0.135","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"Monitor, Update and Config Mgmnt 1.14.01","versionType":"custom"}]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.8-1","versionType":"custom"}]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM)","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMI version: 1.6.8-1","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647","http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"],"weaknesses":[],"ingestedAt":"2026-10-29T19:48:49.871Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/38xxx/CVE-2021-38647.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-38647","state":"PUBLISHED","datePublished":"2021-09-15T11:24:07.000Z","dateUpdated":"2026-08-10T15:10:54.154Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2021-08-13T00:00:00.000Z"},"containers":{"cna":{"title":"Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Azure Automation State Configuration, DSC Extension","versions":[{"version":"2.0.0","status":"affected","lessThan":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Automation Update Management","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Diagnostics (LAD)","versions":[{"version":"3.0.0","status":"affected","lessThan":"LAD v4.0.13 and LAD v3.0.135","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Security Center","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Sentinel","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Azure Stack Hub","versions":[{"version":"1.0.0","status":"affected","lessThan":"Monitor, Update and Config Mgmnt 1.14.01","versionType":"custom"}]},{"vendor":"Microsoft","product":"Container Monitoring Solution","versions":[{"version":"1.0.0","status":"affected","lessThan":"publication","versionType":"custom"}]},{"vendor":"Microsoft","product":"Log Analytics Agent","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMS Agent for Linux GA v1.13.40-0","versionType":"custom"}]},{"vendor":"Microsoft","product":"Open Management Infrastructure","versions":[{"version":"16.0","status":"affected","lessThan":"OMI Version 1.6.8-1","versionType":"custom"}]},{"vendor":"Microsoft","product":"System Center Operations Manager (SCOM)","versions":[{"version":"1.0.0","status":"affected","lessThan":"OMI version: 1.6.8-1","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647","name":"Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"description":"Remote Code Execution","lang":"en-US","type":"Impact"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-08-10T15:10:54.154Z"},"datePublic":"2021-09-14T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0","versionEndExcluding":"OMI Version 1.6.8-1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:system_center_operations_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMI version: 1.6.8-1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_state_configuration:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_automation_update_management:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:log_analytics_agent:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"LAD v4.0.13 and LAD v3.0.135"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:container_monitoring_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"publication"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"OMS Agent for Linux GA v1.13.40-0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"Monitor, Update and Config Mgmnt 1.14.01"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T01:51:18.937Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647","tags":["government-resource"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-38647","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-04T14:45:47.017000Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:25:33.144Z"},"timeline":[{"time":"2021-11-03T00:00:00.000Z","lang":"en","value":"CVE-2021-38647 added to CISA KEV"}]}]}}}