CVE-2021-38645

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 2.73%
EPSS Percentile: 85.86%
CISA KEV: YES — Known Exploited Vulnerability

Description

Open Management Infrastructure Elevation of Privilege Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 15-Sep-2021 19:15
Last Modified: 11-Aug-2026 03:18
EPSS Date: 2026-10-19

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2021-11-03
Remediation Due: 2021-11-17
Known Ransomware Campaign Use: Unknown
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-38645

Affected Products / Versions

microsoft / azure_automation_state_configuration
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
microsoft / azure_automation_update_management
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
microsoft / azure_diagnostics_\(lad\)
Version / affected range: -
cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*
microsoft / azure_security_center
Version / affected range: -
cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*
microsoft / azure_sentinel
Version / affected range: -
cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*
microsoft / azure_stack_hub
Version / affected range: -
cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*
microsoft / container_monitoring_solution
Version / affected range: -
cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
microsoft / log_analytics_agent
Version / affected range: -
cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
microsoft / open_management_infrastructure
Version / affected range: * · before (exclusive) 1.6.8-1
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
microsoft / system_center_operations_manager
Version / affected range: -
cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 23:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Apparently, we can use the recovered secretString to bypass the patch Microsoft introduced to address CVE-2021-38645 (one of the LPE vulnerabilities we disclosed in June 2021) and elevate our privileges to root. OMI Vulnerability Let Attackers Predict a Secret and Escalate to Root
CVE-2021-38645 – Privilege Escalation vulnerability OMIGOD: Four OMI Flaws Expose Azure Linux VMs to Root Compromise
CVE-2021-38645 – Privilege Escalation vulnerability (Severity: 7.8) OMIGOD Flaws Enable Root Access and Code Execution on Azure-Linked Linux Systems

CVE (4)

Malware (1)

People (2)

MITRE ATT&CK (3)

Vendors (1)

Products (10)

Tools (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.