{"id":"CVE-2021-38647","kind":"vulnerability","aliases":["CVE-2021-38647"],"related":[],"title":"Microsoft Open Management Infrastructure (OMI): Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","description":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Open Management Infrastructure (OMI), the management agent bundled in Azure VM Management Extensions, has a remote code execution flaw. An unauthenticated attacker can run code on affected systems, and CISA reports it is being exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.99933,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Open Management Infrastructure (OMI)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["azure","azure-vm-extensions","exploited","infrastructure","linux","omi","ransomware"],"not_affected_if":["no-omi-installed"],"how_to_check":null,"fix":"Apply the Microsoft update for OMI per the vendor instructions (CISA required action: apply updates per vendor instructions); the fixed version is unknown from the sources.","status":"open","published_at":"2021-09-15T12:15:15+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:22+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:43:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for OMI per the vendor instructions (CISA required action: apply updates per vendor instructions); the fixed version is unknown from the sources.\nunknown","reach":"network","impact":"high","summary":"Microsoft Open Management Infrastructure (OMI), the management agent bundled in Azure VM Management Extensions, has a remote code execution flaw. An unauthenticated attacker can run code on affected systems, and CISA reports it is being exploited in the wild, including in ransomware campaigns.","category":"infrastructure","who_cares":["azure","linux","omi","azure-vm-extensions"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server, with possible ransomware deployment.","analyst_note":"Find the affected and fixed OMI versions and detection steps in Microsoft's advisory for CVE-2021-38647 and the Azure VM extension guidance; sources did not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-omi-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000494,"input_tokens":2871,"output_tokens":413,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed OMI versions and detection steps in Microsoft's advisory for CVE-2021-38647 and the Azure VM extension guidance; sources did not give them.","search":"'-2021':16A,19A '-38647':17A,20A 'action':99C 'affect':63B 'agent':43B 'allow':93C 'appli':100C 'attack':58B 'azur':26B,28B,46B,85C 'azure-vm-extens':27B 'bundl':44B 'campaign':78B 'cisa':66B,97C 'code':12A,53B,61B,95C 'contain':89C 'cve':15A,18A 'execut':13A,54B,96C 'exploit':31B,71B 'extens':30B,49B,88C 'flaw':55B 'includ':75B 'infrastructur':4A,9A,32B,39B,82C 'infrastructure':24A 'instruct':104C 'linux':33B 'manag':3A,8A,38B,42B,48B,81C,87C 'management':23A 'microsoft':1A,6A,21A,36B,79C 'omi':5A,10A,25A,34B,40B,83C 'open':2A,7A,22A,37B,80C 'per':102C 'ransomwar':35B,77B 'remot':11A,52B,94C 'report':67B 'requir':98C 'run':60B 'system':64B 'unauthent':57B 'unspecifi':91C 'updat':101C 'vendor':103C 'vm':29B,47B,86C 'vulner':14A,92C 'wild':74B 'within':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-15T12:15:15+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-38647","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-38647","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:33+00:00","note":null},{"source":"epss","external_id":"CVE-2021-38647","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38647","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-38647","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38647","severity":null,"published_at":"2021-09-15T12:15:15+00:00","modified_at":"2026-08-10T20:18:56+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}