CISA's required action for CVE-2021-42287 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Active Directory in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.
How to patch and validate exposure for CVE-2021-42287
The practical answer is to treat this as an urgent Microsoft Active Directory Domain Services remediation task. Confirm every domain controller and related AD DS instance, apply the vendor update or documented mitigation, and if patching cannot happen immediately, reduce exposure by removing internet access or taking the product out of service. The fix is only complete when you have also checked for signs of earlier exploitation.
For incident-driven patching, the priority is not simply getting to “patched,” it is reducing the time the vulnerable service remains reachable. A domain controller that is still exposed while the change is queued remains a live escalation path, so remediation should be paired with containment, asset inventory, and post-fix validation rather than treated as a standalone maintenance task.
Directly exploited vulnerabilities are best handled as a combined patch-and-hunt problem. Use the vendor advisory and the CISA KEV catalogue for the authoritative patch and mitigation details, and follow exploited-vulnerability handling guidance for the emergency workflow that includes prioritisation, temporary exposure reduction, and compromise review.
The surrounding control story is about scope, not just version number. If you cannot yet verify every affected Microsoft Active Directory deployment, you do not yet know whether the vulnerable path still exists in production, staging, or a forgotten recovery environment. That is why the first operational step is always a complete asset pass before you rely on the patch status itself.
Why remediation for Active Directory flaws needs a wider blast-radius check
Active Directory vulnerabilities rarely stay local to one host. Once a domain services issue is exploitable, the consequence can extend into authentication trust, privilege escalation, and lateral movement, so the response has to assume that an attacker may already have used the weakness to reach higher-value credentials or directory roles. That is why remediation must include a log review and compromise assessment, not just software replacement.
Where directory services are reachable from untrusted networks, the exposure is materially worse because the attacker does not need an internal foothold first. If patching is delayed, the safer interim posture is to reduce reachability and make the vulnerable service unavailable to external traffic until the update or mitigation is in place.
Failure mechanism: The flaw is dangerous because an attacker can turn a directory service weakness into elevated directory control, then use that access to blend into normal authentication and administration activity before defenders notice.
Impact: A successful abuse can put accounts, group membership, and downstream systems at risk, which is why post-remediation checks must look for persistence, suspicious directory changes, and signs of credential abuse.
Use the CISA Known Exploited Vulnerabilities Catalog as the external trigger for urgent handling, and pair it with MITRE ATT&CK Enterprise to structure the hunt for privilege escalation, credential access, and lateral movement indicators that can follow directory compromise.
What to do if patching must wait
If you cannot patch immediately, do not leave the vulnerable AD DS service in its normal exposure state. The accepted temporary controls are to remove internet exposure, isolate the affected system, or take the product out of service if the business impact allows it. Those options are not equivalent, but they all reduce the chance that the flaw can be reached before the fix lands.
Temporary mitigation should be documented as an exception with an expiry date, because “we will patch later” is not a control. The control only exists when someone owns the exception, knows which systems remain exposed, and can prove that the workaround is still active until the vendor fix is applied.
Where you need a broader patching decision model, the vulnerability management guide is useful for prioritisation, exceptions, and verification discipline, while NIST National Vulnerability Database gives the canonical CVE record context used by many operational workflows.
After any fix or workaround, validate that the attack surface really changed. For Active Directory, that means checking whether the vulnerable service is still reachable, whether expected ports and management paths remain exposed, and whether the system was restored to a secure configuration rather than merely restarted into the same risk state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Explained vulnerability patching and urgent remediation for exploited AD DS flaws. |
| AC-4 — Information Flow Enforcement | Supports reducing internet exposure and restricting reachability during mitigation. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Supports reviewing logs after patching for signs of earlier exploitation. | |
| Recommendation — Prioritise flaw remediation for the affected AD DS assets and verify the update or mitigation was applied. Restrict network paths to the vulnerable directory service until the fix is deployed. Review audit and directory logs for indicators of compromise after remediation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Directly covers identifying and remediating an actively exploited vulnerability. |
| CIS-12 — Network Infrastructure Management | Supports reducing exposure by controlling network reachability to AD DS. | |
| Recommendation — Track the flaw through continuous vulnerability management until remediation and validation are complete. Limit network exposure to the vulnerable service while the patch is pending. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The CVE is a privilege-escalation flaw and the answer discusses abuse and post-exploit review. |
| T1087 — Account Discovery | Directory compromise often leads to account and group discovery after abuse. | |
| T1078 — Valid Accounts | The answer includes checking for earlier compromise and credential abuse after exploitation. | |
| Recommendation — Hunt for exploitation-for-privilege-escalation activity in directory and security telemetry. Look for account discovery and unusual directory enumeration after suspected exploitation. Investigate suspicious use of valid accounts following the exposure window. | ||
Practitioner Guidance
What to prioritise: Patch and containment should be done together. If the vulnerable AD DS instance is internet-reachable or broadly accessible, reduce exposure first or in parallel, because waiting for the patch without changing reachability leaves the exploit path open.
What to verify: Confirm that every domain controller and dependent directory service instance received the vendor update or documented mitigation, then review security and directory logs for abnormal privilege changes, new administrative memberships, and unusual authentication patterns around the exposure window.
Decision rule: If you cannot prove the system is patched and no longer exposed, treat it as still vulnerable. If you also see signs of directory tampering or suspicious logons, escalate from remediation into incident response and do not stop at patching.
Practitioner takeaway: For exploited Active Directory flaws, the right question is not “was it patched?” but “was exposure removed quickly enough, and did we validate that nothing was already abused before the fix went in?”
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)?
- Is CVE-2021-42287 (Microsoft Active Directory Domain Services Privilege Escalation) being exploited in the wild?
- CVE-2021-42287 (Microsoft Active Directory Domain Services Privilege Escalation)
- CVE-2021-42278 (Microsoft Active Directory Domain Services Privilege Escalation)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org