CVE-2021-38649

Published: Sep 15, 2021Modified: Aug 10, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD (Secondary)

Description

Open Management Infrastructure Elevation of Privilege Vulnerability

Affected (11)

Products: Microsoft: Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics (lad), Azure Open Management Infrastructure, Azure Security Center, Azure Sentinel, Azure Stack Hub, Container Monitoring Solution, Log Analytics Agent, Open Management Infrastructure, System Center Operations Manager

11 products

Azure Automation State Configuration

Azure Automation Update Management

Azure Diagnostics (lad)

Azure Open Management Infrastructure

Azure Security Center

Azure Stack Hub

Container Monitoring Solution

Log Analytics Agent

Open Management Infrastructure

System Center Operations Manager

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Microsoft Azure Automation State Configuration	All versions
Microsoft Azure Automation Update Management	All versions
Microsoft Azure Diagnostics (lad)	All versions
Microsoft Azure Open Management Infrastructure	All versions
Microsoft Azure Security Center	All versions
Microsoft Azure Sentinel	All versions
Microsoft Azure Stack Hub	All versions
Microsoft Container Monitoring Solution	All versions
Microsoft Log Analytics Agent	All versions
Microsoft Open Management Infrastructure	Before 1.6.8-1
Microsoft System Center Operations Manager	All versions

References (3)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649

Source: secure@microsoft.com

PatchVendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38649

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38649

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.