Actively exploited in the wild

Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Microsoft - Open Management Infrastructure (OMI) · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-38647

CriticalCVSS 9.8KEV

Published: 15/09/2021(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.72%

100th percentile - higher than 100% of all known CVEs

Summary

Remote code execution vulnerability in Open Management Infrastructure (OMI). Allows a remote unauthenticated attacker to execute arbitrary code.

Risk Assessment

An attacker can take control of the system, potentially leading to full compromise of the infrastructure.

Recommendation

Install security updates for OMI provided by the vendor.

Original NVD description (English source)

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability