Active Directory Domain Services Elevation of Privilege Vulnerability

published 2021-11-10 4 y ago modified 2026-08-19 2 mo ago also EUVD-2021-29262

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2022-04-11, used in ransomware
epss: 77.2%; EPSS 77.2% chance of exploitation in 30 days, percentile 99.5%
public exploits: 0; none known

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 15 links 2

Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.25769
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.25769
Microsoft Windows Server 2008 Service Pack 2 6.0.6003.21282
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) 6.0.6003.21282
Microsoft Windows Server 2012 6.2.9200.23517
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.23517
Microsoft Windows Server 2012 R2 6.3.9600.20174
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.20174
Microsoft Windows Server 2016 10.0.14393.4770
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.4770
Microsoft Windows Server 2019 10.0.17763.2300
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.2300
Microsoft Windows Server 2022 10.0.20348.350
Microsoft Windows Server version 2004 10.0.19041.1348
Microsoft Windows Server version 20H2 10.0.19041.1348

Timeline

2021-11-10 Published
2022-04-11 Added to CISA KEV
2022-05-02 CISA patch deadline
2025-08-19 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-04-11)
Patch by: 2022-05-02 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, Active Directory
CISA name: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

Conti ransomware gang
BlackBasta ransomware gang
CosmicBeetle affiliate
Fog ransomware gang

reported by thedfirreport.com cisa.gov welivesecurity.com thedfirreport.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 14 mo ago (2025-08-19)

Exploit prediction

77.17% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Microsoft Windows Server 2008 R2 Service Pack 1
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
Microsoft Windows Server 2008 Service Pack 2
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)
Microsoft Windows Server 2012
Microsoft Windows Server 2012 (Server Core installation)
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012 R2 (Server Core installation)
Microsoft Windows Server 2016
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server version 2004
Microsoft Windows Server version 20H2

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2021-42287
vendor-advisory, patch
portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2021-42287
patch, vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42287
government-resource, us-government-resource

Sources

CVE List CVE-2021-42287
NVD CVE-2021-42287

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary