CVE-2021-42287 is a domain services privilege escalation vulnerability in Microsoft Active Directory. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 April 2022, which means attackers have used it in real attacks. Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
What the vulnerability means in Active Directory
CVE-2021-42287 is dangerous because active directory domain services sits at the centre of domain trust, account authority and administrative delegation. A privilege-escalation flaw in that layer can let an attacker move from ordinary access toward broader control of the domain, which is why directory-service issues are treated as high-impact even when the underlying flaw description is brief.
In practice, the key question is not just whether a domain controller is patched, but whether the organisation has enough visibility to know where Active Directory Domain Services is deployed, exposed, and integrated. A vulnerability in directory services can have a much wider blast radius than a typical server flaw because it can affect authentication, authorization, group membership, and the trust relationships that govern the rest of the estate.
Why this kind of privilege escalation is serious
Privilege escalation in Active Directory can change an attacker’s position from foothold to domain-level authority. Once that boundary is crossed, the attacker may be able to create or modify accounts, alter group membership, tamper with policies, or reach systems that were previously off limits. That is why even an “unspecified” directory-services vulnerability is operationally significant: the impact comes from where the weakness lives, not only from the exploit mechanics.
Directory privilege escalation is also attractive because it can blend into normal administration. Legitimate directory changes happen constantly, so malicious activity can hide among routine account management, policy updates, and access changes unless logs and change review are strong enough to separate expected from suspicious behaviour.
How organisations should assess exposure and reduce risk
Exposure assessment starts with an accurate inventory of domain controllers, trust relationships, and the systems that depend on Active Directory for authentication and authorization. Organisations should confirm whether any domain services assets are internet-reachable, indirectly exposed through remote administration paths, or connected to high-value identity infrastructure that would magnify the effect of compromise.
For patch and prioritisation details, readers should consult the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog. For broader exploitability triage and asset-led remediation workflows, see the Vulnerability Management Guide.
If immediate patching is delayed, compensating controls should narrow who can reach domain services, reduce interactive administrative exposure, and harden the surrounding identity tier. The goal is to make exploitation harder, limit lateral movement, and keep the directory service from becoming the easiest path to domain-wide compromise.
Detection, compromise review, and identity impact
Because exploitation in Active Directory often leads to privilege changes rather than obvious malware alone, detection should focus on unusual directory modifications, anomalous admin group changes, unexpected replication or authentication activity, and signs that privileged accounts were used outside their normal patterns. A compromise review should assume that the attacker may have accessed high-value credentials or created persistence inside the directory.
This is why post-exploitation validation matters. Even after the vulnerability is patched, organisations should review privileged account activity, inspect changes to group membership and delegation, and confirm that no unauthorized service accounts, credentials, or trust relationships were altered during the attack window.
The MITRE ATT&CK Enterprise Matrix is useful for mapping the likely follow-on behaviours after directory compromise, especially privilege escalation, credential access, and lateral movement. For organisations that need a control perspective on privileged access in Microsoft environments, the Active Directory and Entra ID Hardening Guide helps frame the surrounding trust boundaries that make this class of flaw dangerous.
Risk and Threat Considerations
This vulnerability is materially risky because Active Directory Domain Services is a control plane for identity and privilege. If an attacker can escalate rights inside that plane, the compromise can spread from one server or account to broad domain authority, turning a local foothold into enterprise-wide access.
Failure mechanism: An attacker abuses the directory-service flaw to cross a privilege boundary, then uses the resulting authority to alter accounts, policies, or trust relationships and extend control.
Impact: Domain compromise can expose credentials, enable persistence, weaken recovery confidence, and create follow-on lateral movement across systems that rely on Active Directory for trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | Active Directory escalation maps to attacker privilege gain through exploitation. |
| Recommendation — Map observed abuse to T1068 and hunt for privilege escalation chains in directory activity. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | AD DS compromise affects user authentication and administrative identity control. |
| AC-6 — Least Privilege | Privilege escalation directly violates least-privilege enforcement in domain administration. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Directory escalation demands review of account, group and policy changes. | |
| Recommendation — Enforce strong user authentication and monitor for anomalous privileged sign-ins. Apply least-privilege access and reduce standing administrative rights in the domain. Review audit trails for unexpected directory modifications and privilege changes. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged access rights | The term concerns escalation into privileged domain access. |
| Recommendation — Restrict and review privileged access rights across domain services. | ||
Practitioner Guidance
What to watch for: Treat any Active Directory Domain Services privilege escalation issue as a high-priority identity incident until proven otherwise. The practical mistake is to view it as a single-server vulnerability when it may actually be a domain-control event.
Practitioner takeaway: Validate exposure, patch through the vendor’s guidance, and review privileged changes as though the directory itself may already have been used as the attacker’s pivot point.
Related resources from NHI Mgmt Group
- Why does a dNSHostName change create such a high privilege escalation risk in Active Directory Certificate Services?
- Why do default Active Directory settings make privilege escalation easier for attackers with basic domain access?
- What should security teams do first when Active Directory privilege escalation flaws could let attackers take over a Windows domain?
- What are the signs that an Active Directory environment may still be vulnerable to CVE-2021-42287 and CVE-2021-42278?