CVE-2021-42278 Microsoft Active Directory Domain Services Privilege Escalation
Attackers can elevate privileges in Active Directory Domain Services on Windows Server, requiring immediate patching by system administrators.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42278?
CVE-2021-42278 is a high-severity vulnerability in Microsoft Windows Server 2008, published on 10 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Active Directory Domain Services Elevation of Privilege Vulnerability
Which versions are affected by CVE-2021-42278?
It affects 7 products.
Products include Microsoft Windows Server 2004, Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022 and 1 more.
How do I fix CVE-2021-42278?
No fix has been published for CVE-2021-42278 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 May 2022.
Is CVE-2021-42278 being exploited?
Yes. Attackers have exploited CVE-2021-42278 in the wild since at least 11 Apr 2022, including in ransomware campaigns.
Public exploit code: 6 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Windows Server 2008
Sources
Also known as GHSA-chp6-c7f5-h9w9.