CVE-2021-42278
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Description
CVE-2021-42278 is a privilege escalation vulnerability in Microsoft Active Directory Domain Services involving the sAMAccountName attribute of computer accounts. The vulnerability allows an authenticated user to manipulate the sAMAccountName of a machine account to impersonate a domain controller, which when combined with CVE-2021-42287 enables complete domain takeover. CISA has added CVE-2021-42278 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 0.02% (89.2nd percentile), this vulnerability is actively exploited as a critical component of the noPac domain escalation attack chain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2004 | < 10.0.19041.1348 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4770 |
| microsoft | windows server 2019 | < 10.0.17763.2300 |
| microsoft | windows server 2022 | < 10.0.20348.350 |
| microsoft | windows server 20h2 | < 10.0.19042.1348 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privilege boundaries. In CVE-2021-42278, Active Directory fails to properly restrict the modification of the sAMAccountName attribute on machine accounts, allowing an authenticated user to rename a machine account to impersonate a domain controller, bypassing critical security assumptions in the Kerberos authentication process.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-42278 is the enabler for one of the most impactful Active Directory attack chains when combined with CVE-2021-42287, collectively known as the "noPac" attack. Any authenticated domain user — even with the lowest possible privileges — can exploit this vulnerability chain to achieve domain administrator access within minutes. The impact is complete domain compromise: full access to all user credentials, the ability to modify any Group Policy, create persistent backdoor accounts, and control all domain-joined systems. The simplicity of the attack and the availability of automated exploitation tools make this vulnerability chain a primary threat for every Active Directory environment worldwide.
Exploit Maturity
CVE-2021-42278 is listed in the CISA Known Exploited Vulnerabilities catalog with confirmed active exploitation. While the EPSS score of 0.02% (89.2nd percentile) appears moderate in isolation, this vulnerability is almost exclusively exploited in combination with CVE-2021-42287, which has a 99.7th percentile EPSS score. The combined "noPac" attack is widely documented, automated in tools like noPac.py and Rubeus, and routinely used in both penetration testing and real-world attacks.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV: install the November 2021 Patch Tuesday updates that address CVE-2021-42278 in Active Directory Domain Services.
- Apply the CVE-2021-42287 patch concurrently, as both vulnerabilities form a single attack chain.
- Monitor for suspicious machine account creation and sAMAccountName modifications through Active Directory audit logs.
- Restrict the ability to create machine accounts by reducing the ms-DS-MachineAccountQuota value from its default of 10 to 0 for standard users.
- Implement Active Directory tiering and privileged access workstations (PAWs) to contain the impact of credential compromise.
Technical Details
CVE-2021-42278 is a privilege escalation vulnerability in Active Directory that allows an authenticated user to modify the sAMAccountName attribute of a machine account they control to match the name of a domain controller (minus the trailing "$"). By default, any authenticated domain user can create up to 10 machine accounts (controlled by ms-DS-MachineAccountQuota), and the Active Directory naming validation does not prevent setting a machine account's sAMAccountName to the name of an existing domain controller. This renamed account is then used to request a Kerberos TGT, after which the account is renamed back to its original name, setting up the CVE-2021-42287 exploitation path where the KDC resolves the orphaned ticket to the domain controller identity.
Frequently Asked Questions
Is CVE-2021-42278 being actively exploited?
Yes. CVE-2021-42278 is listed in the CISA KEV catalog and is actively exploited as part of the "noPac" attack chain in combination with CVE-2021-42287. Automated exploitation tools are widely available.
What products are affected by CVE-2021-42278?
CVE-2021-42278 affects Microsoft Active Directory Domain Services on all supported Windows Server versions operating as domain controllers.
How do I fix CVE-2021-42278?
Install the November 2021 Microsoft security updates on all domain controllers. Also patch CVE-2021-42287 and reduce ms-DS-MachineAccountQuota to 0 for standard users.
How severe is CVE-2021-42278?
CVE-2021-42278 is a critical Active Directory vulnerability that, combined with CVE-2021-42287, enables any domain user to achieve domain admin privileges. This makes it one of the most impactful vulnerability chains affecting enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.