Security readout for executives and security teams
Plain-English summary
CVE-2022-33640 is a high-severity local privilege escalation issue in Microsoft Open Management Infrastructure as used with System Center Operations Manager. An attacker already able to run low-privileged code on an affected host could gain elevated privileges, increasing the impact of an initial foothold.
Executive priority
Treat this as a high-priority patching item for environments using Microsoft SCOM with OMI. It is not described as remotely exploitable from the internet, but it can materially increase damage after an attacker gains local access.
Technical view
The CVE is classified as CWE-269, improper privilege management. Microsoft lists affected OMI 16.0 and SCOM 2016, 2019, and 2022 versions. CVSS 3.1 is 7.8 with local access, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on Linux or Unix-like systems managed by affected Microsoft SCOM deployments that include the listed OMI versions. Public-facing exposure is not indicated by the supplied CVSS vector because exploitation requires local access.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS temporal metric marks exploit code maturity as proof-of-concept, but no exploit details are included here and none should be inferred beyond that.
Researcher notes
Key constraints are local attack vector, low privileges required, no user interaction, and high impact across confidentiality, integrity, and availability. Available evidence identifies affected products and an official vendor advisory, but the bundle does not include detailed root cause, exploit mechanics, or fixed build numbers.
Mitigation direction
- Review Microsoft’s advisory for the official remediation path.
- Patch or update affected SCOM and OMI components per Microsoft guidance.
- Prioritize systems where untrusted users or workloads have local access.
- Restrict local access to managed hosts until remediation is complete.
- Track remediation status for SCOM 2016, 2019, and 2022 estates.
Validation and detection
- Inventory SCOM deployments and managed hosts using OMI.
- Compare installed versions against the affected versions listed in the advisory.
- Confirm Microsoft’s official fix is applied where applicable.
- Review local account and workload access on affected systems.
- Check vulnerability scanner results for CVE-2022-33640 coverage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-33640 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege VulnerabilityCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.