Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Summary

Open Management Infrastructure (OMI), an open-source management server used on Linux systems, is affected by this vulnerability. An attacker could potentially exploit it to run arbitrary code on the affected system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Sep 15, 2021, 11:24 AM UTCCVE published
2. Nov 3, 2021Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Nov 17, 2021CISA remediation deadline

   Due date for US federal agencies to patch

4. Aug 10, 2026, 3:10 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Microsoft Azure Automation State Configuration, DSC Extension

  From 2.0.0 · fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3

• Microsoft Azure Automation Update Management

  From 1.0.0 · fixed in OMS Agent for Linux GA v1.13.40-0

• Microsoft Azure Diagnostics (LAD)

  From 3.0.0 · fixed in LAD v4.0.13 and LAD v3.0.135

• Microsoft Azure Security Center

  From 1.0.0 · fixed in OMS Agent for Linux GA v1.13.40-0

• Microsoft Azure Sentinel

  From 1.0.0 · fixed in OMS Agent for Linux GA v1.13.40-0

• Microsoft Azure Stack Hub

  From 1.0.0 · fixed in Monitor, Update and Config Mgmnt 1.14.01

• Microsoft Container Monitoring Solution

  From 1.0.0 · fixed in publication

• Microsoft Log Analytics Agent

  From 1.0.0 · fixed in OMS Agent for Linux GA v1.13.40-0

• Microsoft Open Management Infrastructure

  From 16.0 · fixed in OMI Version 1.6.8-1

• Microsoft System Center Operations Manager (SCOM)

  From 1.0.0 · fixed in OMI version: 1.6.8-1

References 1