{"id":"CVE-2021-38649","kind":"vulnerability","aliases":["CVE-2021-38649"],"related":[],"title":"Microsoft Open Management Infrastructure (OMI): Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","description":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft's Open Management Infrastructure (OMI), used by Azure VM Management Extensions, has an unspecified flaw that allows privilege escalation. An attacker who already has some access to the machine can gain higher privileges, and CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":0.02887,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Open Management Infrastructure (OMI)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["azure","azure-vm-extensions","exploited","infrastructure","linux","omi"],"not_affected_if":[],"how_to_check":null,"fix":"Apply updates per vendor instructions; the sources give no patched version.","status":"open","published_at":"2021-09-15T12:15:15+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:27+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:43:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions; the sources give no patched version.","reach":"local","impact":"high","summary":"Microsoft's Open Management Infrastructure (OMI), used by Azure VM Management Extensions, has an unspecified flaw that allows privilege escalation. An attacker who already has some access to the machine can gain higher privileges, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["azure","azure-vm-extensions","omi","linux"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Local user gains elevated privileges on the affected host.","analyst_note":"Find the patched OMI version and the exact affected Azure VM extension versions at the Microsoft advisory for CVE-2021-38649, and a command to check installed OMI on Linux VMs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":2867,"output_tokens":915,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the patched OMI version and the exact affected Azure VM extension versions at the Microsoft advisory for CVE-2021-38649, and a command to check installed OMI on Linux VMs.","search":"'-2021':15A,18A '-38649':16A,19A 'access':60B 'action':94C 'activ':73B 'allow':51B,89C 'alreadi':57B 'appli':95C 'attack':55B 'azur':25B,27B,42B,81C 'azure-vm-extens':26B 'cisa':69B,92C 'contain':85C 'cve':14A,17A 'escal':12A,53B,91C 'exploit':30B,74B 'extens':29B,45B,84C 'flaw':49B 'gain':65B 'higher':66B 'infrastructur':4A,9A,31B,38B,78C 'infrastructure':23A 'instruct':99C 'linux':32B 'list':70B 'machin':63B 'manag':3A,8A,37B,44B,77C,83C 'management':22A 'microsoft':1A,6A,20A,34B,75C 'omi':5A,10A,24A,33B,39B,79C 'open':2A,7A,21A,36B,76C 'per':97C 'privileg':11A,52B,67B,90C 'requir':93C 'unspecifi':48B,87C 'updat':96C 'use':40B 'vendor':98C 'vm':28B,43B,82C 'vulner':13A,88C 'within':80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-15T12:15:15+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-38649","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-38649","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-38649","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38649","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-38649","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38649","severity":null,"published_at":"2021-09-15T12:15:15+00:00","modified_at":"2026-08-10T20:15:27+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}