CVE-2021-38647CRITICAL
Microsoft Azure Automation State Configuration, DSC Extension — Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .9993 100.0 YES
AFFECTED Product Versions Fixed Azure Automation State Configuration, DSC Extension 2.0.0 – — Azure Automation Update Management 1.0.0 – — Azure Diagnostics (LAD) 3.0.0 – — Azure Security Center 1.0.0 – — Azure Sentinel 1.0.0 – — Azure Stack Hub 1.0.0 – — Container Monitoring Solution 1.0.0 – — Log Analytics Agent 1.0.0 – — Open Management Infrastructure 16.0 – — System Center Operations Manager (SCOM) 1.0.0 – —
TIMELINE Aug 13 Reserved by microsoft Nov 3 Added to CISA KEV, remediation due 2021-11-17 Nov 3 Published (CNA: microsoft) Aug 10 EXPLOIT PUBLISHED — CVE-2021-38647 (Microsoft Azure Automation State Configuration, DSC Extension). Public exploit reference added.
CNA: microsoft · CVSS v3.1 · 4 references · NVD status: Analyzed · KEV due November 17, 2021