CVE-2021-38647

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 99.93%
EPSS Percentile: 99.97%
CISA KEV: YES — Known Exploited Vulnerability

Description

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 15-Sep-2021 19:15
Last Modified: 11-Aug-2026 03:18
EPSS Date: 2026-10-19

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2021-11-03
Remediation Due: 2021-11-17
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-38647

Affected Products / Versions

microsoft / azure_automation_state_configuration
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
microsoft / azure_automation_update_management
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
microsoft / azure_diagnostics_\(lad\)
Version / affected range: -
cpe:2.3:a:microsoft:azure_diagnostics_\(lad\):-:*:*:*:*:*:*:*
microsoft / azure_security_center
Version / affected range: -
cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*
microsoft / azure_sentinel
Version / affected range: -
cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*
microsoft / azure_stack_hub
Version / affected range: -
cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*
microsoft / container_monitoring_solution
Version / affected range: -
cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
microsoft / log_analytics_agent
Version / affected range: -
cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
microsoft / open_management_infrastructure
Version / affected range: * · before (exclusive) 1.6.8-1
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
microsoft / system_center_operations_manager
Version / affected range: -
cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 23:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

Wiz Research found and reported the previous four vulnerabilities in OMI in June 2021, including an unauthenticated remote code execution vulnerability dubbed “OMIGOD” (CVE-2021-38647). Azure Adds Opt-In Automatic Updates for Three Agents That Include OMI
in June 2021, including an unauthenticated remote code execution vulnerability dubbed “OMIGOD” (CVE-2021-38647). OMI Vulnerability Let Attackers Predict a Secret and Escalate to Root
CVE-2021-38647 – Unauthenticated RCE as root OMIGOD: Four OMI Flaws Expose Azure Linux VMs to Root Compromise
CVE-2021-38647 – Unauthenticated RCE as root (Severity: 9.8) OMIGOD Flaws Enable Root Access and Code Execution on Azure-Linked Linux Systems

CVE (4)

Malware (1)

People (2)

MITRE ATT&CK (3)

Vendors (2)

Products (15)

Tools (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.