CVE-2022-29149

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 0.92%
EPSS Percentile: 59.63%
CISA KEV: Not listed

Description

Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 16-Jun-2022 05:15
Last Modified: 17-Jun-2026 11:39
EPSS Date: 2026-10-19

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / azure_automation_state_configuration
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
microsoft / azure_automation_update_management
Version / affected range: -
cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
microsoft / azure_diagnostics
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.0.137
cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
microsoft / azure_diagnostics
Version / affected range: * · from (inclusive) 4.0 · before (exclusive) 4.0.27
cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
microsoft / azure_security_center
Version / affected range: * · before (exclusive) 1.14.13
cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
microsoft / azure_sentinel
Version / affected range: * · before (exclusive) 1.14.13
cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
microsoft / azure_stack_hub
Version / affected range: * · before (exclusive) 1.14.13
cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
microsoft / container_monitoring_solution
Version / affected range: -
cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
microsoft / log_analytics_agent
Version / affected range: -
cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
microsoft / open_management_infrastructure
Version / affected range: * · before (exclusive) 1.6.9-1
cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
microsoft / system_center_operations_manager
Version / affected range: 2016
cpe:2.3:a:microsoft:system_center_operations_manager:2016:-:*:*:*:*:*:*
microsoft / system_center_operations_manager
Version / affected range: 2019
cpe:2.3:a:microsoft:system_center_operations_manager:2019:-:*:*:*:*:*:*
microsoft / system_center_operations_manager
Version / affected range: 2022
cpe:2.3:a:microsoft:system_center_operations_manager:2022:-:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 23:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

install them. Recently, as part of Microsoft’s June 2022 Patch Tuesday, an update was included to fix CVE-2022-29149, a new local privilege escalation vulnerability in OMI. Azure Adds Opt-In Automatic Updates for Three Agents That Include OMI
June 2022 Patch Tuesday, Microsoft published a patch to fix a new privilege escalation vulnerability, CVE-2022-29149 in Open Management Infrastructure (OMI), with a CVSS score of 7.8 (the highest score possible for OMI Vulnerability Let Attackers Predict a Secret and Escalate to Root

CVE (2)

MITRE ATT&CK (1)

Vendors (2)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.