noPac is the name for two Active Directory vulnerabilities, CVE-2021-42278 and CVE-2021-42287. Together they let a standard domain user gain domain admin privileges. CVE-2021-42278 lets an attacker impersonate a domain controller through sAMAccountName spoofing, and CVE-2021-42287 affects the Kerberos Privilege Attribute Certificate. Microsoft released the first patch on November 9, 2021.
Updated
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2021-42287KEV Active Directory Domain Services Elevation of Privilege Vulnerability | Active Directory Domain Services Elevation of Privilege Vulnerability | Microsoft | 7.5 | 77.2% | KEV | 2021-11-10 |
| CVE-2021-42278KEV Active Directory Domain Services Elevation of Privilege Vulnerability | Active Directory Domain Services Elevation of Privilege Vulnerability | Microsoft | 7.5 | 73.3% | KEV | 2021-11-10 |
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Part of the noPac pair of Active Directory flaws; this CVE covers missing validation of machine account names (sAMAccountName spoofing). Combined with CVE-2021-42287, it lets a standard domain user obtain domain admin privileges.
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Part of the noPac pair; this CVE concerns the Kerberos Privilege Attribute Certificate (PAC) handling in the KDC, which can issue a ticket for the wrong, more privileged account. It is exploited together with CVE-2021-42278.
| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2021-42278 | 2022-04-11 | 2022-05-02 | Known use |
| CVE-2021-42287 | 2022-04-11 | 2022-05-02 | Known use |
| CVE | Vendor | Product | Versions |
|---|---|---|---|
| CVE-2021-42278 | Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.7601.0 to <6.1.7601.25769 |
| CVE-2021-42278 | Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.1.7601.0 to <6.1.7601.25769 |
| CVE-2021-42278 | Microsoft | Windows Server 2008 Service Pack 2 | 6.0.6003.0 to <6.0.6003.21282 |
| CVE-2021-42278 | Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.6003.0 to <6.0.6003.21282 |
| CVE-2021-42278 | Microsoft | Windows Server 2012 | 6.2.9200.0 to <6.2.9200.23517 |
| CVE-2021-42278 | Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 to <6.2.9200.23517 |
| CVE-2021-42278 | Microsoft | Windows Server 2012 R2 | 6.3.9600.0 to <6.3.9600.20174 |
| CVE-2021-42278 | Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 to <6.3.9600.20174 |
| CVE-2021-42278 | Microsoft | Windows Server 2016 | 10.0.14393.0 to <10.0.14393.4770 |
| CVE-2021-42278 | Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 to <10.0.14393.4770 |
| CVE-2021-42278 | Microsoft | Windows Server 2019 | 10.0.17763.0 to <10.0.17763.2300 |
| CVE-2021-42278 | Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 to <10.0.17763.2300 |
| CVE-2021-42278 | Microsoft | Windows Server 2022 | 10.0.20348.0 to <10.0.20348.350 |
| CVE-2021-42278 | Microsoft | Windows Server version 2004 | 10.0.0 to <10.0.19041.1348 |
| CVE-2021-42278 | Microsoft | Windows Server version 20H2 | 10.0.0 to <10.0.19042.1348 |
| CVE-2021-42287 | Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.7601.0 to <6.1.7601.25769 |
| CVE-2021-42287 | Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.1.7601.0 to <6.1.7601.25769 |
| CVE-2021-42287 | Microsoft | Windows Server 2008 Service Pack 2 | 6.0.6003.0 to <6.0.6003.21282 |
| CVE-2021-42287 | Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.6003.0 to <6.0.6003.21282 |
| CVE-2021-42287 | Microsoft | Windows Server 2012 | 6.2.9200.0 to <6.2.9200.23517 |
| CVE-2021-42287 | Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 to <6.2.9200.23517 |
| CVE-2021-42287 | Microsoft | Windows Server 2012 R2 | 6.3.9600.0 to <6.3.9600.20174 |
| CVE-2021-42287 | Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 to <6.3.9600.20174 |
| CVE-2021-42287 | Microsoft | Windows Server 2016 | 10.0.14393.0 to <10.0.14393.4770 |
| CVE-2021-42287 | Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 to <10.0.14393.4770 |
| CVE-2021-42287 | Microsoft | Windows Server 2019 | 10.0.17763.0 to <10.0.17763.2300 |
| CVE-2021-42287 | Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 to <10.0.17763.2300 |
| CVE-2021-42287 | Microsoft | Windows Server 2022 | 10.0.20348.0 to <10.0.20348.350 |
| CVE-2021-42287 | Microsoft | Windows Server version 2004 | 10.0.0 to <10.0.19041.1348 |
| CVE-2021-42287 | Microsoft | Windows Server version 20H2 | 10.0.0 to <10.0.19041.1348 |
noPac is the name for two Active Directory vulnerabilities, CVE-2021-42278 and CVE-2021-42287. Together they let a standard domain user gain domain admin privileges. CVE-2021-42278 lets an attacker impersonate a domain controller through sAMAccountName spoofing, and CVE-2021-42287 affects the Kerberos Privilege Attribute Certificate. Microsoft released the first patch on November 9, 2021.
noPac covers two CVEs: CVE-2021-42278 and CVE-2021-42287.
2 of the 2 noPac CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2021-42278 (added 2022-04-11) and CVE-2021-42287 (added 2022-04-11).
The highest CVSS base score among the noPac CVEs is 7.5 (HIGH), for CVE-2021-42278.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.