Exploited· due 2021-11-177.8highHigh

CVE-2021-38648

Microsoft Azure Automation State Configuration

Open Management Infrastructure Elevation of Privilege Vulnerability

Exploitation status

CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
US federal civilian agencies are required to remediate it by 2021-11-17. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
A vendor advisory or patch reference has been published.

Apply updates per vendor instructions.

CISA’s wording, unedited.

It is requires local access to the machine.
For an attacker who can reach it, no special conditions are needed to exploit it.
To exploit it, an ordinary user account is needed.
Beyond that, no action by a user is required.

As listed in the NVD configuration data. Not a statement about your estate.