Skip to content
OpenAdvisories
High · 7.5 Known exploited · Ransomware Public exploit CVE-2021-42278 EUVD-2021-29254GHSA-chp6-c7f5-h9w9

Active Directory Domain Services Elevation of Privilege Vulnerability

Published Nov 10, 2021 · Updated Aug 19, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows Server 2008 R2 Service Pack 1 Product: Windows Server 2008 R2 Service Pack 1 (Server Core installation) Product: Windows Server 2008 Service Pack 2 Product: Windows Server 2008 Service Pack 2 (Server Core installation) Product: Windows Server 2012 Product: Windows Server 2012 (Server Core installation) Product: Windows Server 2012 R2 Product: Windows Server 2012 R2 (Server Core installation) Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server version 2004 Product: Windows Server version 20H2 Platform: Windows

Description

Active Directory Domain Services Elevation of Privilege Vulnerability

Affected products

VendorProductAffectedFixed
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.0 – < 6.1.7601.25769 6.1.7601.25769
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.0 – < 6.1.7601.25769 6.1.7601.25769
Microsoft Windows Server 2008 Service Pack 2 6.0.6003.0 – < 6.0.6003.21282 6.0.6003.21282
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) 6.0.6003.0 – < 6.0.6003.21282 6.0.6003.21282
Microsoft Windows Server 2012 6.2.9200.0 – < 6.2.9200.23517 6.2.9200.23517
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.0 – < 6.2.9200.23517 6.2.9200.23517
Microsoft Windows Server 2012 R2 6.3.9600.0 – < 6.3.9600.20174 6.3.9600.20174
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 – < 6.3.9600.20174 6.3.9600.20174
Microsoft Windows Server 2016 10.0.14393.0 – < 10.0.14393.4770 10.0.14393.4770
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.0 – < 10.0.14393.4770 10.0.14393.4770
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.2300 10.0.17763.2300
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.2300 10.0.17763.2300
Microsoft Windows Server 2022 10.0.20348.0 – < 10.0.20348.350 10.0.20348.350
Microsoft Windows Server version 2004 10.0.0 – < 10.0.19041.1348 10.0.19041.1348
Microsoft Windows Server version 20H2 10.0.0 – < 10.0.19042.1348 10.0.19042.1348

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

  • safebuffer/sam-the-admin ★ 1,073 · Dec 11, 2021

    Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

  • Ridter/noPac ★ 1,030 · Dec 13, 2021

    Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

  • ly4k/Pachine ★ 279 · Dec 13, 2021

    Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

  • waterrr/noPac ★ 6 · Dec 13, 2021

    Exploiting CVE-2021-42278 and CVE-2021-42287

  • cybersecurityworks553/noPac-detection ★ 2 · Dec 27, 2021

    Detection script for CVE-2021-42278 and CVE-2021-42287

  • xLTJ/noPac ★ 0 · Jul 7, 2026

    Go implementation of NoPac, exploiting CVE-2021-42278 and CVE-2021-42287

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References