Is CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?

What “exploited in the wild” means for this CVE

For this question, the important distinction is not whether a proof-of-concept exists, but whether defenders should assume real attackers are already using the flaw. CISA’s KEV catalogue is the practical signal here because it reflects confirmed exploitation, not just theoretical risk. For Microsoft Active Directory Domain Services, that means the issue belongs in urgent remediation queues, not routine backlog.

When a domain service vulnerability is tied to privilege escalation, the security concern is broader than the initial flaw. In an Active Directory environment, successful exploitation can become a path to higher rights, wider directory control, and follow-on abuse of trust relationships inside the Windows estate.

Why this matters operationally in an Active Directory environment

The reason this class of issue is treated as urgent is that identity infrastructure often sits at the centre of enterprise access control. If an attacker can elevate privileges inside domain services, they may be able to reach accounts, groups, delegation paths, and administrative workflows that were never intended to be exposed to them.

This is also why prioritisation should follow exploitability and blast radius, not just patch calendar order. Our Zero-Day and Exploited Vulnerabilities Guide covers the same triage logic that applies when CISA has already confirmed in-the-wild use. The right response is to assume active targeting until you have evidence that your estate is unaffected.

What to verify before you treat it as contained

Start by confirming whether the affected Microsoft Active Directory Domain Services component is present in any production or lab environment that can influence production identity workflows. Then verify whether the vulnerable systems were exposed during the time window before remediation, because exploitation of directory services often leaves limited but meaningful traces.

If patching is delayed, you should still reduce exposure by tightening administrative reach, limiting who can touch domain controllers and related management paths, and looking for signs that privileged accounts or directory objects were changed unexpectedly. The control problem is not just the CVE itself, but the access path it may have opened.

Risk and Threat Considerations

A privilege-escalation flaw in domain services is dangerous because it can convert a lower-value foothold into a much more powerful position inside the directory. In practice, that may let an intruder move from initial access to administrative control, persistence, or broader lateral movement before defenders notice.

Failure mechanism: The attacker abuses the vulnerability to gain elevated rights in Active Directory Domain Services, then uses those rights to alter access, impersonate privileged activity, or stage follow-on compromise.

Impact: The organisation may lose trust in directory integrity, suffer wider account compromise, and need to assume that identity-dependent systems and administrative workflows were exposed.

Practitioner Guidance

What to prioritise: Treat any confirmed exposure as a directory-security incident, not just a patching task. If the vulnerable system supports production authentication or administrative delegation, prioritise containment and exposure review before lower-severity maintenance work.

What to verify: Check whether domain controller-adjacent logs, privileged group membership, delegation settings, or recently changed objects show suspicious activity. If you cannot establish clean state, assume the attacker may have used the window to escalate further.

Decision rule: If remediation must wait, reduce the number of principals that can administer or reach the affected systems, and increase monitoring of privileged changes until the fix is applied. Where directory trust is uncertain, privilege review should move ahead of normal change scheduling.

Practitioner takeaway: For an exploited directory-services CVE, the question is not whether an exploit exists, but whether your identity plane may already be compromised enough to justify emergency response.

Related resources from NHI Mgmt Group

• Is CVE-2021-42287 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?
• Is CVE-2022-26923 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?
• How do you patch or mitigate CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)?
• CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)