CVE-2021-42278
Microsoft Windows Server 2008 r2
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-42278 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-42278 is an elevation of privilege vulnerability affecting Active Directory Domain Services. It carries a CVSS 3.1 base score of 7.5 with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a remotely exploitable flaw that can yield high impact to confidentiality, integrity, and availability when successfully triggered.
An attacker with low privileges and network access can exploit the issue, though the high attack complexity requirement limits the ease of successful abuse. Successful exploitation allows the attacker to elevate privileges within the Active Directory environment, potentially leading to domain-level compromise.
Microsoft has published security guidance addressing the vulnerability, and the flaw appears in CISA's catalog of known exploited vulnerabilities, confirming observed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-29254
Vulnerability Data
Active Directory Domain Services Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 April 2022
Related Threats
Threat-Actor AttributionAI
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.