Security readout for executives and security teams
Plain-English summary
This vulnerability affects Microsoft Active Directory Domain Services on Windows Server. A low-privileged attacker could potentially elevate privileges in an Active Directory environment, putting domain control and business authentication at risk. CISA lists it in KEV, so treat it as actively exploited and not merely theoretical.
Executive priority
High priority. This affects core identity infrastructure and is listed as known exploited by CISA. Patch verification should be treated as an identity-security risk, not routine server maintenance.
Technical view
CVE-2021-42287 is an AD DS elevation-of-privilege vulnerability with CVSS 3.1 score 7.5. The vector indicates network access, low privileges, no user interaction, high attack complexity, and high confidentiality, integrity, and availability impact. Microsoft lists affected Windows Server versions from 2008 through 2022.
Likely exposure
Organizations running Active Directory on affected Windows Server domain controllers may be exposed, especially if November 2021-era Microsoft security updates were missed or inconsistently applied.
Exploitation context
Active exploitation is supported by CISA KEV listing. The provided bundle does not include exploit mechanics, observed campaigns, or specific indicators, so exposure assessment should focus on affected AD DS hosts and patch status.
Researcher notes
The source bundle confirms affected Microsoft Windows Server products, CVSS vector, official remediation availability, and KEV status. It does not provide root-cause detail, exploitation procedure, or indicators. Avoid assuming product impact beyond Microsoft AD DS on listed Windows Server versions.
Mitigation direction
- Apply Microsoft security updates referenced in the MSRC advisory for each affected Windows Server version.
- Prioritize domain controllers and other AD DS servers before lower-risk systems.
- Use CISA KEV status to drive emergency remediation timelines.
- Check vendor guidance for any environment-specific prerequisites or follow-up hardening.
- Document exceptions where legacy Windows Server versions cannot be updated promptly.
Validation and detection
- Inventory all domain controllers and map OS versions to Microsoft’s affected product list.
- Confirm relevant Microsoft security updates are installed on each AD DS server.
- Check CISA KEV for required remediation status and due-date context.
- Review patch-management records for failed or deferred domain-controller updates.
- Escalate any unpatched affected domain controller as a high-priority exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-42287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.65.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42287CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42287CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.