CVE-2021-42287
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Description
CVE-2021-42287 is a privilege escalation vulnerability in Microsoft Active Directory Domain Services that allows an authenticated domain user to impersonate a domain controller and gain domain administrator privileges. When combined with CVE-2021-42278 (sAMAccountName spoofing), this vulnerability enables a low-privileged domain user to obtain full domain admin access. CISA has added CVE-2021-42287 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 95.8% (99.7th percentile), this is one of the most dangerous Active Directory vulnerabilities in recent years.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4770; 2004 |
| microsoft | windows server 2019 | < 10.0.17763.2300 |
| microsoft | windows server 2022 | < 10.0.20348.350 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privileges, allowing actors to operate outside their intended authorization scope. In CVE-2021-42287, Active Directory Domain Services improperly handles Kerberos PAC (Privilege Attribute Certificate) validation during service ticket requests, allowing an authenticated user to obtain tickets with elevated privileges by exploiting the KDC's failure to verify PAC information correctly.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-42287, particularly when combined with CVE-2021-42278, represents one of the most critical Active Directory attack paths because it allows any authenticated domain user to escalate to domain administrator privileges. The confidentiality impact is total — domain admin access grants unrestricted access to all domain-joined systems, user accounts, credentials, and sensitive data across the entire Active Directory forest. The integrity impact is equally devastating, as domain administrators can modify Group Policy, create backdoor accounts, manipulate trust relationships, and alter security configurations across the entire domain. The EPSS score of 95.8% (99.7th percentile) confirms near-certain exploitation, and the combination with CVE-2021-42278 creates one of the simplest domain takeover attack chains available.
Exploit Maturity
CVE-2021-42287 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 95.8% (99.7th percentile) reflects near-certain exploitation probability. Public proof-of-concept tools that combine CVE-2021-42287 with CVE-2021-42278 are widely available and trivially usable, enabling any penetration tester or attacker with standard domain credentials to achieve domain admin access. The attack has been integrated into numerous offensive security tools and is routinely used in both red team operations and real-world attacks.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV: install the November 2021 Patch Tuesday updates that address CVE-2021-42287 in Active Directory Domain Services.
- Also apply the patch for CVE-2021-42278, as both vulnerabilities are commonly exploited together for domain privilege escalation.
- Monitor Active Directory for suspicious Kerberos activity, including unusual service ticket requests, machine account creation, and sAMAccountName modifications.
- Enable advanced audit policies for Kerberos authentication events and Active Directory object modifications to detect exploitation attempts.
- Implement Active Directory tiering to limit the impact of credential compromise and restrict domain admin usage to Tier 0 systems only.
Technical Details
CVE-2021-42287 exploits a flaw in how Active Directory's Key Distribution Center (KDC) handles Kerberos Privilege Attribute Certificate (PAC) information during TGS (Ticket Granting Service) requests. When a user requests a service ticket and the KDC cannot find the account referenced in the TGS request, it appends a "$" to the account name and retries the lookup. Combined with CVE-2021-42278 (which allows renaming a machine account's sAMAccountName to match a domain controller), an attacker can: (1) create a machine account, (2) rename it to match a DC's name, (3) request a TGT, (4) rename the account back, and (5) use the TGT to request a service ticket that the KDC resolves to the domain controller, granting domain admin-equivalent access.
Frequently Asked Questions
Is CVE-2021-42287 being actively exploited?
Yes. CVE-2021-42287 is listed in the CISA KEV catalog with confirmed active exploitation. The 99.7th percentile EPSS score confirms near-certain exploitation, and public tools make the attack trivially accessible.
What products are affected by CVE-2021-42287?
CVE-2021-42287 affects Microsoft Active Directory Domain Services across all supported Windows Server versions running as domain controllers.
How do I fix CVE-2021-42287?
Install the November 2021 Microsoft security updates on all domain controllers. Also apply the CVE-2021-42278 patch, as both vulnerabilities are exploited together. Monitor for suspicious Kerberos activity.
How severe is CVE-2021-42287?
CVE-2021-42287 is among the most critical Active Directory vulnerabilities, enabling any authenticated domain user to achieve domain admin access. Combined with CVE-2021-42278, it provides one of the simplest complete domain takeover attack chains available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.