KEV · Actively exploited
CVE-2021-42278
HIGH 7.5
KEV
Active Directory Domain Services Elevation of Privilege Vulnerability
Attack vector : Network
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
70.21%
exploit likely
percentile 99.3%
CISA Known Exploited Vulnerability
- Added to KEV
- 2022-04-11
- Remediation deadline
- 2022-05-02
- Required action
- Apply updates per vendor instructions.
- Ransomware
- Yes, known ransomware campaign
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.
- Windows Server 2022 Fixed in 10.0.20348.350
- Windows Server 2019 Fixed in 10.0.17763.2300
- Windows Server 2016 Fixed in 10.0.14393.4770