CVE-2021-42287

Active Directory Domain Services is the “company address book” that helps computers find who is allowed to log in and what they can do. This bug can allow an attacker to jump to higher privileges (more control) than they should have—similar to escalating from a regular user to an administrator on your core authentication servers. Because it has been used in ransomware campaigns, leaving it unpatched increases the risk of an attacker taking over your environment.

This matters if you run Windows Server versions that provide Active Directory Domain Services (domain controllers and related AD infrastructure). CISA has confirmed this issue has been used in ransomware campaigns, which increases the practical risk to organizations running these systems. This is a risk specifically where the affected Windows Server AD services are present and reachable in an attacker’s path (for example, from networks an attacker can reach after initial access).

This is RED because CISA lists CVE-2021-42287 as a confirmed KEV used in ransomware campaigns. If attackers get initial access to your Windows AD environment, this elevation-of-privilege flaw can help them gain the higher control they need to push further damage. Patch immediately according to Microsoft’s fixed versions for every affected domain controller.

Confirm whether you’re exposed

• Identify all machines running Active Directory Domain Services (domain controllers) across your Windows Server fleet.
• For each affected server, check its installed updates / OS build level against the Microsoft fixed versions listed for CVE-2021-42287.

Upgrade to the fixed versions (per branch)

Apply the Microsoft security updates so each server reaches at least:

• Windows Server 2008 R2: 6.1.7601.25769
• Windows Server 2008: 6.0.6003.21282
• Windows Server 2012: 6.2.9200.23517
• Windows Server 2012 R2: 6.3.9600.20174
• Windows Server 2016: 10.0.14393.4770
• Windows Server 2019: 10.0.17763.2300
• Windows Server 2022: 10.0.20348.350
• Windows Server 10.0.19041: 10.0.19041.1348
• Windows Server 10.0.19042: 10.0.19042.1348

Vendor guidance (Microsoft):

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287

Timeline / due date

• This CVE was added to CISA KEV on 2022-04-11 with a remediation due date of 2022-05-02.

If you can’t patch right away (temporary containment)

• Limit network exposure of domain controllers: restrict inbound access to only what’s required.
• Ensure your perimeter and remote-access pathways are locked down so attackers have fewer opportunities to reach AD services.
• Plan a rapid patch window; elevation-of-privilege issues in AD are high-value targets.

After patching (what to watch)

• Confirm domain controller stability and authentication services are functioning normally.
• Review security logs for suspicious patterns around the time of any suspected intrusion (e.g., unusual privilege changes or administrative activity).
• Maintain monitoring for signs of continued compromise (especially if you use ransomware recovery plans or incident response playbooks).

CVE-2021-42287 is an Active Directory Domain Services elevation of privilege vulnerability affecting multiple Windows Server versions. CISA includes it in the Known Exploited Vulnerabilities (KEV) program, indicating it has been used in ransomware campaigns; this is the primary driver for urgency.

Weakness type is listed by NVD as not specified (CWE: NVD-CWE-noinfo). No public exploit code is recorded in the findings, but real-world exploitation is confirmed through KEV.

EPSS is shown in the findings as a high predicted likelihood with a falling trend; however, because KEV confirms real-world use, that operational reality outweighs prediction for prioritization.

Patch availability: Microsoft provides fixed versions per supported Windows Server branches (listed in the fix section). Apply those updates to remove the vulnerable condition on affected domain controllers.