Privilege Escalation in Microsoft Open Management Infrastructure (OMI) (CVE‑2021‑38649) Affects Azure VM Extensions
What It Is — Microsoft Open Management Infrastructure (OMI), a component of Azure VM Management Extensions, contains an unspecified flaw that permits privilege escalation.
Exploitability — No public exploit code is known, but an attacker with limited access to a VM could leverage the flaw to obtain higher privileges. CVSS v3.1 base score 7.8 (High).
Affected Products — Microsoft Azure Virtual Machines that include the OMI component (default Azure VM images that ship the management extensions).
Why It Matters for Trust & Control Assurance
- Tests the control objective of vulnerability and patch management – timely remediation is a key audit evidence point across frameworks (e.g., NIST CSF, ISO 27001).
- Highlights the need for continuous monitoring of cloud‑host components to demonstrate due‑diligence to regulators and customers.
- Provides a concrete data point for the Trust Center, enabling organizations to produce defensible evidence of control effectiveness and remediation timelines.
Recommended Actions
- Inventory all Azure VMs running OMI and verify the installed version.
- Apply Microsoft’s security update for CVE‑2021‑38649 without delay.
- Enable continuous compliance monitoring to capture patch‑status evidence.
- Document remediation steps and retain logs for audit purposes.
Source: CISA KEV – CVE‑2021‑38649