CVE DatabaseCVE-2021-38647

Updated 2026-08-10한국어 권고문 →

CVE-2021-386479.8/CRITICALCISA KEV

Microsoft Azure Open Management Infrastructure (OMI) Remote Code Execution and Authentication Bypass Vulnerability (CVE-2021-38647) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

open management infrastructure, omi

Published Date

2021-09-15

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.9%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Open Management Infrastructure (OMI) versions prior to 1.6.8-1, commonly deployed automatically on Microsoft Azure Linux Virtual Machines

Impact

Unauthenticated remote attackers can execute arbitrary commands with root privileges on the target system by sending a specially crafted HTTP/S request

Mitigation

Immediately upgrade the OMI package to version 1.6.8-1 or higher, and restrict network access to OMI ports (5985, 5986) using firewalls

Affected Products & Version Scope

All versions of Microsoft Open Management Infrastructure (OMI) prior to 1.6.8-1 (including instances deployed via Azure Linux VM extensions)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Update the OMI agent to the latest secure version (1.6.8-1 or higher) using the system package manager.

bash

# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade omi

# For RHEL/CentOS-based systems
sudo yum update omi -y

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, block external access to the OMI service ports (5985 and 5986) using host-based firewalls.

bash

# Block OMI ports using iptables
sudo iptables -A INPUT -p tcp --dport 5985 -j DROP
sudo iptables -A INPUT -p tcp --dport 5986 -j DROP

# Block OMI ports using UFW (Ubuntu)
sudo ufw deny proto tcp from any to any port 5985
sudo ufw deny proto tcp from any to any port 5986

3. Log Audit & IoC Verification Commands

Verify the currently installed OMI version and inspect system logs for potential exploitation attempts or unauthorized command executions.

bash

# 1. Check the installed OMI version
/opt/omi/bin/omiserver -v

# 2. Search OMI logs for potential exploitation patterns (e.g., command execution attempts)
grep -Ei 'execute|shell|command' /var/opt/omi/log/omiserver.log 2>/dev/null

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Datadog Cloud & Kubernetes Security

Due to active exploitation in the wild, immediately upgrade OMI to version 1.6.8-1 or higher and restrict network exposure of ports 5985 and 5986.

Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet

Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.

Real-Time Production Container CVE Mapping

Start 14-Day Free Cloud Security Trial

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (popularly known as 'OMIGOD') is a critical authentication bypass and remote code execution (RCE) flaw in Open Management Infrastructure (OMI), an open-source CIM/WMI provider widely used in Microsoft Azure Linux environments. The root cause lies in a logical flaw (CWE-287) within the OMI authentication mechanism. When processing incoming HTTP/S requests, OMI fails to properly validate the 'Authorization' header. If a request is sent without an Authorization header or with an empty value, OMI incorrectly trusts the request as an internally-initiated local communication, granting full administrative access without verifying credentials.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending a crafted SOAP (Simple Object Access Protocol) request over HTTP (port 5985) or HTTPS (port 5986) to an exposed OMI server. By omitting the 'Authorization' header from the request, the attacker bypasses the authentication layer entirely. The OMI server processes the request and executes the embedded command (e.g., via the ExecuteShellCommand class) under the context of the OMI service, which runs with root privileges. This allows complete, unauthenticated remote code execution with a single network packet.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk to cloud infrastructure. Because several Azure Linux VM extensions (such as Log Analytics, Azure Diagnostics, and Azure Automation) silently install and run OMI in the background, many organizations may be vulnerable without their explicit knowledge. Successful exploitation allows attackers to gain full root access, leading to lateral movement, data exfiltration, ransomware deployment, or unauthorized resource utilization (e.g., cryptojacking).

Official Vendor Advisories & References

NVD Original English Description

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647

Source: secure@microsoft.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-38647)

FAQ

Q1. How critical is CVE-2021-38647 and is it actively exploited in the wild?

CVE-2021-38647 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-38647?

Primary impacted vendors include microsoft across open management infrastructure, omi. Scope summary: All versions of Microsoft Open Management Infrastructure (OMI) prior to 1.6.8-1 (including instances deployed via Azure Linux VM extensions)

Q3. What temporary mitigations or workarounds exist for CVE-2021-38647 before patching?

[Mitigation] Immediately upgrade the OMI package to version 1.6.8-1 or higher, and restrict network access to OMI ports (5985, 5986) using firewalls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION