CISA Known Exploited Vulnerability

CVE-2021-38645

Microsoft · Open Management Infrastructure (OMI)

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Date added 2021-11-03

BOD 22-01 due date 2021-11-17

CWE —

Ransomware Unknown

CISA description

Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.

Required action

Apply updates per vendor instructions.

Notes & references

https://nvd.nist.gov/vuln/detail/CVE-2021-38645

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2021-38645
CVE.org · CVE-2021-38645
CISA KEV catalog (canonical)