Product of Microsoft

Open Management Infrastructure (OMI)

As of , 4 Microsoft Open Management Infrastructure (OMI) vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2021-38647.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2021-38647Remote Code ExecutionMicrosoft Open Management Infrastructure (OMI)Patch this weekRansomware use; Metasploit module; EPSS 0.990.99
2CVE-2021-38648Privilege EscalationMicrosoft Open Management Infrastructure (OMI)Patch this weekMetasploit module0.11
3CVE-2021-38649Privilege EscalationMicrosoft Open Management Infrastructure (OMI)Patch soon0.03
4CVE-2021-38645Privilege EscalationMicrosoft Open Management Infrastructure (OMI)Patch soon0.03

Added each year

12342021: 4420212022: nonenone20222023: nonenone20232024: nonenone20242025: nonenone20252026: nonenone2026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20214
2022none
2023none
2024none
2025none
2026none

Used in ransomware