CVE-2021-42278Vulnerability
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Reported by 4 independent sources · first reported by Group-IB · last reported
Last reported 3 days ago
Fix due 2 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“noPac – This tool was used to exploit CVE-2021-42278 and CVE-2021-42287 to escalate to Domain Admin and dump domain credentials”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“CVE-2021-42278/42287 (noPac)Windows ADAttempted, failed”
-
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF“In instances where the victim had not patched for CVE-2021-42278 and CVE-2021-42287, the adversary used a ‘noPac’ attack.”
-
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025“CVE-2021-42278 / CVE-2021-42287 (noPac): Machine account creation + sAMAccountName write.”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2021-42278”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“This technique allowed the attacker to exploit two vulnerabilities in the domain controller: CVE-2021-42278 (sAMAccount Spoofing) and CVE-2020-1472.”
Indicators reported together
named in the same reports- exploit[.]inin 1 report
Copy this indicator · defanged
Also named with it: CVE-2021-42287, CVE-2020-1472, CVE-2024-3400, CVE-2025-49113, CVE-2026-35616, CVE-2017-11882, CVE-2023-38831, CVE-2023-36884, CVE-2026-0257, CVE-2026-81578, CVE-2026-82078, CVE-2017-5753, CVE-2022-27925, CVE-2021-26855, CVE-2023-20198, CVE-2024-21762, CVE-2022-41082, CVE-2025-64446, CVE-2023-23397
Thanks — we review every report.