CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

CVE-2021-42287 is a privilege escalation vulnerability in Microsoft Active Directory Domain Services. An attacker who can already operate in a domain environment may be able to gain higher privileges than intended. CISA notes known ransomware use associated with this issue, so domain controllers and related Active Directory infrastructure deserve prompt attention. Confirm all product, version, and fix details against the Microsoft vendor advisory before acting.

How it works

The weakness is classified as CWE-269 (Improper Privilege Management). In plain terms, Active Directory Domain Services does not correctly enforce the boundary between lower-privileged and higher-privileged operations under certain conditions. An attacker who already has some foothold in the domain can abuse that gap to elevate privileges.

Public detail on the exact abuse path is limited in the provided record. Treat it as a classic domain privilege-escalation flaw: once elevated, the attacker can typically create or modify accounts, alter group membership, or take further control of domain resources. Do not rely on unconfirmed exploit write-ups; validate behavior and detection guidance against the official Microsoft advisory.

Am I affected? How to find it in your systems

This affects Microsoft Active Directory Domain Services, which runs on domain controllers in Windows Server environments that host AD DS. Inventory every domain controller, including those in child domains, forests, and any RODCs or staging systems.

• Enumerate domain controllers via Active Directory Users and Computers, PowerShell (for example, Get-ADDomainController), or your CMDB/asset inventory.
• Record OS build, AD DS role status, and patch level for each DC; compare against the fixed builds listed in the Microsoft advisory for CVE-2021-42287.
• Check configuration baselines and any deferred or staged patching rings that may have left DCs unpatched.
• Review security event logs and SIEM data on DCs for unusual privilege changes, unexpected account or group modifications, and authentication anomalies that could indicate escalation attempts. Specific event IDs and telemetry signatures should be taken from Microsoft and your detection vendors rather than assumed.

If you cannot map a system to a patched build listed by Microsoft, treat it as potentially affected until confirmed otherwise.

How to remediate

Patch first. Apply the updates Microsoft released for this vulnerability exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions.

• Prioritize domain controllers and any servers holding critical AD DS roles.
• Use your standard change process: test in a representative lab or pilot OU, then roll out to production DCs with monitoring for replication and authentication health.
• After patching, verify installed updates and reboot status; confirm the CVE is listed as addressed on each DC.
• Reinforce general AD hardening for this class of issue: least-privilege admin models, tiered administration, protected users/groups, and tight control over who can join machines to the domain or modify privileged groups.

Do not substitute unofficial patches or registry tweaks for the vendor update unless Microsoft explicitly documents them as supported mitigations.

If you can't patch immediately

Reduce exposure until the official update can be installed.

• Segment domain controllers: restrict management access to dedicated admin workstations and jump hosts; limit network paths to DCs to only required ports and sources.
• Enforce strict privileged-access controls: minimize accounts with rights that could be abused for escalation; monitor and alert on changes to high-privilege groups.
• Increase monitoring and logging on DCs and identity systems; forward logs to a SIEM and alert on anomalous privilege use or mass account changes.
• If your security stack supports virtual patching or identity-threat detection rules for AD privilege escalation, enable vendor-recommended signatures for this CVE class after validating them.
• Disable or restrict any nonessential features or legacy protocols on DCs only if Microsoft guidance supports doing so without breaking domain operations.

These steps lower risk; they do not replace the vendor patch.

If your data may have been exposed

Privilege-escalation flaws in Active Directory that are tied to ransomware activity can lead to full domain compromise and data theft or encryption. If you suspect exploitation, isolate affected systems, preserve logs, reset potentially compromised credentials (especially privileged ones), and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data to see whether your identities already appear in public breach corpora.