CVE-2021-42278: high-severity vulnerability in Microsoft Windows Server 2008 R2 Service Pack 1
Active Directory Domain Services Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in Active Directory Domain Services allows an authenticated attacker to escalate their privileges to domain administrator level. An attacker with a regular user account can abuse this vulnerability to gain complete control over the entire domain.
CVE-2021-42278 is a privilege escalation vulnerability in AD DS that allows an authenticated attacker to elevate privileges to domain admin via improper validation of certificate requests. The attack vector requires prior authentication and exploits the certificate enrollment process to impersonate a domain controller or administrative account.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.