CVE-2021-42278: Microsoft Active Directory (High, CVSS 7.5)
CVE-2021-42278HighKEVPublic exploitMicrosoft Active Directory
- CVSS
- 7.5 High (v3.1)
- EPSS
- 73.3% chance of exploitation in the next 30 days (higher than 99.4% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Apr 11, 2022; used by ransomware
- Public exploit
- Yes, reported in 6 GitHub repositories
- Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Published
- Nov 10, 2021
- CISA fix-by date
- May 2, 2022 (for US federal agencies)
What it is
Active Directory Domain Services Elevation of Privilege Vulnerability
Description from the National Vulnerability Database.
What to do
CISA: Apply updates per vendor instructions.
Check whether you run Microsoft Active Directory, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.
Advisories and fixes
ThreatRoundup coverage
HighCVE-2025-64446CVE-2019-6693+3 CVEs
k0t Walks In Through Fortinet and GlobalProtect, Leaves With 70,000 Logins
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.