Security readout for executives and security teams
Plain-English summary
A low-privileged attacker can target Active Directory over the network and potentially gain elevated control. Because Active Directory governs organizational identities and access, successful exploitation could compromise sensitive data, account integrity, and service availability. CISA’s KEV listing confirms exploitation has occurred, making unpatched domain controllers an urgent concern.
Executive priority
Treat this as an urgent identity-infrastructure remediation item. Confirm domain-controller coverage promptly, patch affected systems through controlled emergency processes, and require explicit exception handling for anything unresolved. Active Directory’s central role and the KEV designation make delayed remediation materially riskier than the 7.5 score alone may suggest.
Technical view
CVE-2021-42278 is an Active Directory Domain Services elevation-of-privilege vulnerability. Its CVSS 3.1 vector indicates network access, high attack complexity, low privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact. The supplied evidence does not describe the underlying flaw, CWE, update KBs, or fixed build thresholds.
Likely exposure
Exposure is likely where affected Windows Server releases operate Active Directory Domain Services and the applicable Microsoft update is absent. Listed products span Windows Server 2008 SP2 through 2022, including several Server Core installations and versions 2004 and 20H2. The bundle does not establish exposure for systems outside that list.
Exploitation context
CISA’s Known Exploited Vulnerabilities designation supports that this vulnerability has been exploited in the wild. The supplied sources do not identify campaigns, threat actors, exploitation prevalence, or present targeting levels. The high-complexity rating should not be treated as evidence that exploitation is merely theoretical.
Researcher notes
The bundle establishes affected products, CVSS characteristics, vendor patch availability, and known exploitation. It does not provide flaw mechanics, CWE classification, exploit prerequisites beyond the vector, indicators of compromise, KB mappings, or fixed builds. Researchers should use Microsoft’s advisory for those details and avoid inferring them from similarly timed Active Directory vulnerabilities.
Mitigation direction
- Apply Microsoft’s applicable CVE-2021-42278 security update to every affected Active Directory server.
- Prioritize affected domain controllers, including Server Core installations, for expedited remediation.
- Consult Microsoft’s advisory for applicable updates, prerequisites, and supported servicing instructions.
- Escalate legacy systems lacking a confirmed update for isolation or vendor-supported treatment.
Validation and detection
- Inventory all domain controllers and identify operating-system versions matching the affected list.
- Compare installed updates with Microsoft’s applicability information for CVE-2021-42278.
- Confirm no affected domain controller, including Server Core, remains without the applicable update.
- Review monitoring records for unexplained Active Directory account or privilege changes.
- Document systems whose patch or support status cannot be conclusively established.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-42278 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.65.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2021-42278 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2022-04-11T00:00:00.000Z: CVE-2021-42278 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Active Directory Domain Services Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42278CVE reference, CVE · x_refsource_MISC, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42278CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.