As reported by Microsoft - during the November security update cycle, a patch was released for vulnerabilities CVE-2021-42287 and CVE-2021-42278. Both vulnerabilities are described as a ‘Windows Active Directory domain service privilege escalation vulnerability’. When combining 42287 and 42278, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn’t applied these new updates. This escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain. On December 12, 2021, a proof-of-concept tool leveraging these vulnerabilities was publicly disclosed.

The initial patch and vulnerability disclosure was published at: Follow-up guide from Microsoft following the proof-of-concept disclosure is available at:

Active POC code is circulating in the wild, and Active Directory administrators are strongly encouraged to upgrade immediately. The Fortinet Security Fabric protections below can help detect the vulnerability, prevent exploit, or hunt for indicators related to these vulnerabilities across the attack surface.