CVE-2021-42287 Microsoft Active Directory Domain Services Privilege Escalation
Attackers can elevate privileges in Active Directory Domain Services on Windows Server, requiring immediate patching by system administrators.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42287?
CVE-2021-42287 is a high-severity vulnerability in Microsoft Windows Server 2008, published on 10 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Active Directory Domain Services Elevation of Privilege Vulnerability
Which versions are affected by CVE-2021-42287?
It affects 7 products.
Products include Microsoft Windows Server 2004, Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022 and 1 more.
How do I fix CVE-2021-42287?
No fix has been published for CVE-2021-42287 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 May 2022.
Is CVE-2021-42287 being exploited?
Yes. Attackers have exploited CVE-2021-42287 in the wild since at least 11 Apr 2022, including in ransomware campaigns.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Windows Server 2008
Sources
Also known as GHSA-737r-5j68-97hh.