CVE-2021-42278

Active Directory is the “front door” and permission system for your Windows network. This vulnerability is a weakness that can allow someone to jump from a lower level to higher control inside that system—like moving from being a regular employee to being an administrator without permission. If it’s reachable, attackers can use it to take over accounts and drive ransomware activity.

This matters if you run Active Directory Domain Services on Microsoft Windows Server versions listed in the affected set (Windows Server 2008/2008 R2/2012/2012 R2/2016/2019/2022). Because it’s targeted at domain controller functionality, successful compromise can affect the whole domain.

Reachability gate: it becomes a real risk when your domain controllers are reachable from the attacker’s path and can be used in the specific attack conditions described in Microsoft’s advisory; this is actively used in ransomware campaigns per CISA KEV.

This is RED because it is confirmed in CISA’s Known Exploited Vulnerabilities list and has been used in ransomware campaigns. Attackers actively target Active Directory weaknesses to gain higher privileges and then spread or encrypt systems. You should treat patching of affected domain controllers as immediate work, not a routine update.

Confirm exposure

• Find every server that has the Active Directory Domain Services role (domain controllers), and note its Windows Server version.
• For each domain controller, verify the current OS build number.

Match to the fixed versions

Apply Microsoft’s update for CVE-2021-42278 and confirm your domain controllers end up on one of these fixed builds:

• Windows Server (10.0.19041.x): fixed in 10.0.19041.1348
• Windows Server (10.0.19042.x): fixed in 10.0.19042.1348
• Windows Server 2016: fixed in 10.0.14393.4770
• Windows Server 2019: fixed in 10.0.17763.2300
• Windows Server 2022: fixed in 10.0.20348.350
• Windows Server 2008: fixed in 6.0.6003.21282
• Windows Server 2008 R2: fixed in 6.1.7601.25769
• Windows Server 2012: fixed in 6.2.9200.23517
• Windows Server 2012 R2: fixed in 6.3.9600.20174

Upgrade/patch path

• Use Microsoft’s official update instructions for CVE-2021-42278 (MSRC advisory/update guide).
• Plan for a reboot as part of applying the fix, and re-check the build number after the restart.

Temporary workaround (if patching is delayed)

• Reduce unauthorized reachability to domain controllers by tightening network segmentation and firewall rules so only required management and client networks can reach Active Directory services.
• Review remote access paths (VPN, jump hosts, exposed management interfaces) to ensure they are controlled and access-restricted.

KEV deadline

• CISA remediation due date: 2022-05-02.

What to monitor after changes

• Validate authentication and directory service health.
• Review security logs for suspicious privilege changes or account modifications occurring around the time of exposure/attempts.

CVE-2021-42278 is an Active Directory Domain Services elevation of privilege in Microsoft Windows Server. It is in CISA KEV (added 2022-04-11) and has been used in ransomware campaigns, which makes it an active, real-world risk for organizations with reachable domain controllers. No public exploit code was found in the provided findings, but KEV status indicates it has been exploited in the wild.

Mechanism (high-level): attackers leverage a weakness tied to Active Directory Domain Services to elevate privileges, enabling domain-level impact such as account compromise and downstream ransomware activity.

Exploit maturity/exposure signal: confirmed exploitation per KEV; exploitation availability in public code is not required for attackers to succeed. Press attention is sustained, but urgency is driven by KEV confirmation.