Microsoft System Center Operations Manager — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft System Center Operations Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (17)

• CVE-2021-38647 — CVSS 9.8 (critical) — actively exploited: Open Management Infrastructure Remote Code Execution Vulnerability
• CVE-2024-21334 — CVSS 9.8 (critical): Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
• CVE-2026-20967 — CVSS 8.8 (high): Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
• CVE-2021-1728 — CVSS 8.8 (high): System Center Operations Manager Elevation of Privilege Vulnerability
• CVE-2024-21330 — CVSS 7.8 (high): Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
• CVE-2022-29149 — CVSS 7.8 (high): Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
• CVE-2025-27743 — CVSS 7.8 (high): Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
• CVE-2021-38645 — CVSS 7.8 (high) — actively exploited: Open Management Infrastructure Elevation of Privilege Vulnerability
• CVE-2021-38648 — CVSS 7.8 (high) — actively exploited: Open Management Infrastructure Elevation of Privilege Vulnerability
• CVE-2022-33640 — CVSS 7.8 (high): System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
• CVE-2021-41352 — CVSS 7.5 (high): SCOM Information Disclosure Vulnerability
• CVE-2021-38649 — CVSS 7.0 (high) — actively exploited: Open Management Infrastructure Elevation of Privilege Vulnerability
• CVE-2023-36043 — CVSS 6.5 (medium): Open Management Infrastructure Information Disclosure Vulnerability
• CVE-2020-1331 — CVSS 5.4 (medium): A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to…
• CVE-2013-0009 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject…
• CVE-2015-2420 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and…
• CVE-2013-0010 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject…