Upgrade System Center Operations Manager

Hi,

Thank you for the update.

If Administration > Operations Manager Products > Web Servers shows version 10.19.10658.0 and KB5073251 is reflected there, this indicates that the Web Console hotfix itself was applied successfully on that Web Console server.

One important clarification: KB5073251 is a Web Console hotfix, not a full Management Server update package. The Microsoft KB for this hotfix includes only:

KB5073251-amd64-WebConsole.msp

The issue fixed by this hotfix is also Web Console specific: it limits the ability to edit PowerShell widgets to administrators only. Therefore, I would not necessarily expect all binaries under:

C:\Program Files\Microsoft System Center\Operations Manager\Server\

to change from 10.19.10649.0 to 10.19.10658.0. That folder belongs to the Management Server component, while this specific MSRC hotfix patches the Web Console component.

Microsoft’s build version article lists 10.19.10658.0 / KB5073251 / March 2026 / Update Rollup 6 MSRC hotfix, so the target build number is correct. However, for this hotfix the relevant component to validate is the Web Console, not necessarily every file under the Management Server Server directory.

The next thing I would check is the exact evidence reported by the vulnerability scanner:

1. Which server name/IP is being reported?

Is the scanner checking the load-balanced Web Console URL or a specific node?

Which exact file name under C:\Program Files\Microsoft System Center\Operations Manager\Server\ is still detected as vulnerable?

Is the scanner detecting the installed product version, a file version, or only the folder-level product path?

Do you have more than one Web Console server behind a load balancer?

If there are multiple Web Console servers, please confirm that all Web Console nodes show 10.19.10658.0 under:

Administration > Operations Manager Products > Web Servers

If only one node was patched, the vulnerability scanner may still hit an unpatched Web Console node through the load balancer.

I would also suggest checking the file versions specifically under the Web Console path, for example:

Get-ChildItem "C:\Program Files\Microsoft System Center\Operations Manager\WebConsole" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.VersionInfo.FileVersion -like "10.19.*" } |
Select-Object FullName,
              @{Name="FileVersion";Expression={$_.VersionInfo.FileVersion}},
              @{Name="ProductVersion";Expression={$_.VersionInfo.ProductVersion}} |
Sort-Object FullName

You can also compare this with the Management Server folder:

Get-ChildItem "C:\Program Files\Microsoft System Center\Operations Manager\Server" -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.VersionInfo.FileVersion -like "10.19.*" } |
Select-Object FullName,
              @{Name="FileVersion";Expression={$_.VersionInfo.FileVersion}},
              @{Name="ProductVersion";Expression={$_.VersionInfo.ProductVersion}} |
Sort-Object FullName

If the Web Console component is already at 10.19.10658.0, but the scanner is still flagging files under the Server folder with 10.19.10649.0, then this may be a detection issue in the vulnerability scanner. In that case, the scanner may be expecting the Management Server component to have the same build number as the Web Console hotfix, even though KB5073251 only provides the Web Console MSP.

Recommended next steps:

Confirm all Web Console servers are patched.

Restart IIS or reboot the Web Console server after patching, if this has not already been done.

Run a fresh authenticated scan against each Web Console node directly, not only the load-balanced URL.

Compare the scanner evidence with the actual Web Console file versions.

If the scanner reports only the ...\Operations Manager\Server\ path, ask the VA/scanner team or vendor to confirm whether their detection logic correctly handles the fact that KB5073251 is Web Console-only.

Provide them the evidence that the SCOM console shows the Web Server component at 10.19.10658.0 and that KB5073251 is installed.

So, based on what you described, I do not currently think you missed an additional SCOM Management Server update for this specific CVE. The important point is to confirm whether the scanner is checking the correct component and whether all Web Console nodes were patched.

I hope I was able to help you out!

Best Regards
Stoyan

"If my response was useful, please consider marking it as the answer. It keeps the forum clean, structured, and more helpful for everyone. Thank you for supporting the community."