CVE-2021-38647

Published: Sep 15, 2021

Modified: Oct 21, 2025

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Open Management Infrastructure Remote Code Execution Vulnerability

Vendor	Product	Versions
Microsoft	Open Management Infrastructure	affected `16.0 - < OMI Version 1.6.8-1`
Microsoft	System Center Operations Manager (SCOM)	affected `1.0.0 - < OMI version: 1.6.8-1`
Microsoft	Azure Automation State Configuration, DSC Extension	affected `2.0.0 - < DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3`
Microsoft	Azure Automation Update Management	affected `1.0.0 - < OMS Agent for Linux GA v1.13.40-0`
Microsoft	Log Analytics Agent	affected `1.0.0 - < OMS Agent for Linux GA v1.13.40-0`
Microsoft	Azure Diagnostics (LAD)	affected `3.0.0 - < LAD v4.0.13 and LAD v3.0.135`
Microsoft	Container Monitoring Solution	affected `1.0.0 - < publication`
Microsoft	Azure Security Center	affected `1.0.0 - < OMS Agent for Linux GA v1.13.40-0`
Microsoft	Azure Sentinel	affected `1.0.0 - < OMS Agent for Linux GA v1.13.40-0`
Microsoft	Azure Stack Hub	affected `1.0.0 - < Monitor, Update and Config Mgmnt 1.14.01` affected `1.0.0 - < 3.1.135`

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

x_refsource_MISC

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.