How do you patch or mitigate CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2021-42278 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Active Directory in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What patching CVE-2021-42278 means in practice

CVE-2021-42278 is not a case where you can meaningfully “half fix” the problem. The right response is to identify every Microsoft Active Directory Domain Services instance, apply the vendor update or documented mitigation, and treat exposure as a security project, not a one-off patch job. For active exploitation, use the Zero-Day and Exploited Vulnerabilities Guide to align patching with emergency triage, and rely on the vendor advisory and CISA KEV catalogue for exact version guidance.

The operational detail that matters most is scope. If your estate includes domain controllers, test systems, lab forests, or legacy Active Directory dependencies, each one needs to be checked separately. This is especially important when the vulnerable path may exist in more than one environment or when administrators assume the “main” domain is the only place that matters.

When you are sequencing the work, the safest approach is to pair remediation with validation. The patch or mitigation should be followed by confirmation that the affected systems are still authenticating normally, replication is healthy, and no compensating control has introduced a broader outage than the vulnerability itself.

How to mitigate when patching must wait

If you cannot patch immediately, reduce the chance that the vulnerable service can be reached or abused. For this class of issue, that usually means limiting exposure, isolating the affected systems from unnecessary network paths, and taking the product out of service if you cannot reduce the risk in a controlled way. Where a broader exposure-control decision is needed, the Active Directory and Entra ID Hardening Guide is the most direct internal reference for tightening the surrounding identity attack surface.

Mitigation should also be judged against business continuity. If the domain services are still exposed but unpatched, compensating controls are only temporary risk reduction. They do not remove the underlying escalation path, so the exception should have a short expiry, clear ownership, and a confirmed remediation date.

If you need a broader control path for the identity layer around the vulnerable service, the Privileged Access Management Guide helps frame which administrative paths should be narrowed while the fix is being staged.

What to check after patching or mitigation

After the fix is applied, the next task is compromise assessment, not celebration. Because this flaw was exploited in the wild, review authentication, directory, and administrative activity for signs that attackers used the window before remediation. Look for unusual logon patterns, privilege changes, abnormal account creation, suspicious directory changes, and signs that a domain-level foothold was established.

It is also worth checking whether the vulnerability was chained with other identity abuse. A domain escalation issue can be paired with stolen credentials, token abuse, or later movement that did not depend on the flaw alone. The State of NHI & AI Agent Breach Report 2026 is useful here because it reinforces the broader pattern: once attackers obtain durable identity access, they often reuse it across multiple systems.

If you find evidence of compromise, rotate credentials and review any privileged sessions or delegated access that may have been exposed. For Active Directory estates, the clean-up question is usually not only whether the patch landed, but whether any identity material, trust relationship, or admin path needs to be rebuilt.

Risk and Threat Considerations

The risk is not just service disruption. Active Directory escalation flaws can give an attacker elevated control over authentication, group membership, and downstream systems that trust the directory. If exploitation occurs before patching, the result can be rapid privilege gain and broad lateral movement, especially in environments where domain administration is not tightly segmented.

Failure mechanism: A known privilege-escalation weakness in directory services lets an attacker turn limited access into higher privilege, then use that position to expand control across the environment before defenders notice.

Impact: Loss of directory integrity can cascade into account takeover, persistence, and wider compromise of systems that depend on the affected domain.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE patching and mitigation depend on rapid asset discovery and remediation prioritization.
Recommendation — Track every Active Directory asset and remediate the vulnerable service through a time-bound vulnerability process.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about applying the vendor update or mitigation for a known flaw.
	AU-6 — Audit Review, Analysis, and Reporting	Post-patch log review is central because exploitation may have occurred before remediation.
	AC-6 — Least Privilege	Mitigation includes reducing exposure and constraining privileged paths around Active Directory.
Recommendation — Apply the vendor update or approved mitigation and document remediation completion. Review authentication and directory logs for indicators of earlier exploitation. Restrict administrative reach and remove unnecessary privilege paths until the fix is in place.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE is a privilege-escalation weakness and attacker technique mapping is directly relevant.
	T1078 — Valid Accounts	After escalation, attackers often persist by abusing trusted directory accounts and access paths.
Recommendation — Map detections to privilege-escalation behavior and hunt for post-exploit admin gain. Look for account misuse and unexpected trusted access after the vulnerability is exploited.

Practitioner Guidance

What to prioritise: Patch every exposed Active Directory instance first, then confirm whether any internet-facing or externally reachable dependency still increases attack surface. If you cannot patch immediately, treat isolation or service removal as a time-bounded exception, not a permanent control.

What to verify: Validate that the fix closed the vulnerable path and that your post-change review covers directory logs, privileged activity, and any signs of earlier exploitation. A successful patch without compromise review is incomplete for an exploited CVE.

Practitioner takeaway: For an actively exploited directory privilege-escalation flaw, the real objective is to close the exposure and then prove the domain was not already used as an escalation point.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org