CVE-2021-42287Vulnerability
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Reported by 3 independent sources · first reported by GreyNoise · last reported
Last reported 3 days ago
Fix due 2 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“noPac – This tool was used to exploit CVE-2021-42278 and CVE-2021-42287 to escalate to Domain Admin and dump domain credentials”
-
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF“In instances where the victim had not patched for CVE-2021-42278 and CVE-2021-42287, the adversary used a ‘noPac’ attack.”
-
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025“CVE-2021-42278 / CVE-2021-42287 (noPac): Machine account creation + sAMAccountName write.”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2021-42287”
Indicators reported together
named in the same reportsAlso named with it: CVE-2021-42278, CVE-2017-11882, CVE-2023-38831, CVE-2023-36884, CVE-2026-0257, CVE-2026-81578, CVE-2026-82078, CVE-2017-5753, CVE-2020-1472, CVE-2022-27925, CVE-2021-26855, CVE-2023-20198, CVE-2024-21762, CVE-2022-41082, CVE-2025-64446, CVE-2023-23397, CVE-2024-3400, CVE-2021-44228, CVE-2024-1709, CVE-2024-1708
Thanks — we review every report.