Is CVE-2021-42287 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2021-42287 to its Known Exploited Vulnerabilities catalogue on 11 April 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for this CVE

This question is really about whether the vulnerability has crossed from theoretical exposure into active attacker use. For a Windows directory services flaw, that changes the response posture immediately: the issue is not just a patching task, it is an incident-priority remediation problem. The relevant questions become whether the vulnerable service is present, whether the environment has been exposed long enough to be targeted, and whether compensating controls can reduce blast radius while remediation is underway.

For vulnerability triage, “known exploited” status is a stronger signal than generic risk scoring because it reflects observed abuse, not just exploitability. That is why teams should treat the CISA KEV catalog as the primary operational trigger and then validate whether their own estate contains the affected product, especially in environments with domain controllers or legacy directory service dependencies.

How to confirm exposure and decide on immediate action

The first practical step is to verify where the affected Microsoft Active Directory Domain Services component exists in your estate, then identify whether any internet-adjacent, hybrid, or privileged directory paths could increase exposure. If the product is present, the remediation path should follow the vendor advisory and the CISA KEV entry rather than an internal patch queue built around normal maintenance windows. In a directory services context, delay is costly because the same control plane that supports authentication and authorization can also support escalation if abused.

If patching cannot happen at once, reduce opportunity for exploitation by narrowing administrative access, watching for unusual directory privilege changes, and increasing scrutiny on domain-controller-adjacent activity. Directory service weaknesses often become high-value initial access or escalation points because they sit near the trust anchor for the rest of the environment. The most important decision is whether you can safely defer, or whether temporary containment is required until the fix is deployed.

Teams that need a structured response path should use the Zero-Day and Exploited Vulnerabilities Guide to align KEV-driven prioritisation, emergency mitigation, and post-patch verification with the rest of the response process.

What to look for after patching or mitigation

When a directory privilege-escalation flaw has been publicly exploited, patching alone is not enough. You should look for earlier compromise indicators around directory changes, abnormal privileged account use, and any signs that attackers attempted to establish persistence before the fix was applied. If a domain service was exposed during the vulnerable period, the investigation should extend beyond the specific CVE to the broader identity and privilege layer.

That means checking whether high-value accounts were touched, whether new privileged objects appeared, whether authentication or delegation settings changed unexpectedly, and whether any systems relied on the directory service for follow-on access. Even when no obvious compromise is found, the absence of evidence should be treated cautiously if logging was limited or retention was short. In practice, the safer assumption is that active exploitation was possible before patching, so the validation window should match the exposure window, not just the patch date.

For broader credential and privilege fallout patterns after active exploitation, the Vulnerability Management Guide helps frame remediation, verification, and exception handling as one continuous control process rather than a one-time patch event.

Risk and Threat Considerations

This kind of flaw matters because Active Directory Domain Services sits at the centre of enterprise trust. If an attacker can escalate privileges there, the result can be rapid expansion from one foothold to broad control over users, systems, and policy enforcement. CISA’s KEV listing and ransomware note mean the concern is not abstract, it is a proven attack path with operational consequences.

Failure mechanism: Privilege escalation in directory services can let an attacker convert limited access into elevated control, then reuse that trust to move laterally, alter accounts, or prepare ransomware deployment.

Impact: The likely impact is loss of domain trust, faster attacker persistence, and a much larger recovery effort if directory-level changes or credential abuse occurred before remediation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require priority-based vulnerability handling and verification.
Recommendation — Prioritise KEV-listed vulnerabilities for immediate remediation and validation.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about an exploited vulnerability and how exposure should be verified.
	SI-2 — Flaw Remediation	A KEV-listed flaw demands rapid patching or mitigation in affected systems.
Recommendation — Continuously identify, track, and remediate exploitable vulnerabilities. Apply fixes or compensating controls quickly for known exploited flaws.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE is an Active Directory privilege-escalation weakness with attacker abuse potential.
	T1134 — Access Token Manipulation	Directory privilege escalation often leads to identity and privilege abuse after initial access.
Recommendation — Map observed activity to privilege-escalation techniques and hunt for post-exploit actions. Look for abuse of elevated identity material and session-based privilege expansion.

Practitioner Guidance

What to verify: Confirm whether the affected directory service exists anywhere in production, test, or hybrid-connected environments, then verify whether the vulnerable system was reachable during the exposure window. If the answer is yes, treat the issue as a compromise-assessment candidate, not only as a patch ticket.

Decision rule: If the affected product was present and exposure was possible before remediation, prioritise patching, directory-change review, and privilege review together. If logs are incomplete or the system was internet-reachable, assume the blast radius may be larger than the vulnerability record alone suggests.

Practitioner takeaway: For exploited directory-service flaws, the right order is confirm exposure, close the path, and then prove no privilege abuse occurred, because remediation without validation leaves the trust layer uncertain.