How severe is CVE-2022-30190?

CVE-2022-30190 has a CVSS 3.1 base score of 7.8 (HIGH). EPSS estimates a 99.2% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

Follina (CVE-2022-30190): Microsoft Windows Support Diagnostic Tool

Q: What is Follina?

Follina is the common name for CVE-2022-30190. Follina is the name for a remote code execution flaw in the Microsoft Support Diagnostic Tool (MSDT) that can be triggered from a Word document, made public in late May 2022 after a sample was shared by the researcher account nao_sec. Microsoft issued workaround guidance and reported exploitation in the wild.

CISA Known Exploited Vulnerabilities

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-06-14

Remediation due

2022-07-05

Ransomware

Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2022-30190

Also Known as Follina

Follina is the name for a remote code execution flaw in the Microsoft Support Diagnostic Tool (MSDT) that can be triggered from a Word document, made public in late May 2022 after a sample was shared by the researcher account nao_sec. Microsoft issued workaround guidance and reported exploitation in the wild.

Name sources

Description

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Severity

CVSS 3.1 · CNA7.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Exploitation Context

as of October 14, 2026

All KEV statistics→

CISA added CVE-2022-30190 to the KEV catalog 13 days after its CVE record was published.
It is one of 391 Microsoft entries in the CISA KEV catalog, and one of 166 added in 2022.
Its current EPSS score (99.2%) is higher than that of 87% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
Microsoft	Microsoft Windows 10 Version 1809	10.0.17763.0 to <10.0.17763.3046
Microsoft	Microsoft Windows 10 Version 1809	10.0.0 to <10.0.17763.3046
Microsoft	Microsoft Windows Server 2019	10.0.17763.0 to <10.0.17763.3046
Microsoft	Microsoft Windows Server 2019 (Server Core installation)	10.0.17763.0 to <10.0.17763.3046
Microsoft	Microsoft Windows 10 Version 21H1	10.0.0 to <10.0.19043.1766
Microsoft	Microsoft Windows Server 2022	10.0.20348.0 to <10.0.20348.770
Microsoft	Microsoft Windows 10 Version 20H2	10.0.0 to <10.0.19042.1766
Microsoft	Microsoft Windows Server version 20H2	10.0.0 to <10.0.19042.1766
Microsoft	Microsoft Windows 11 version 21H2	10.0.0 to <10.0.22000.739
Microsoft	Microsoft Windows 10 Version 21H2	10.0.19043.0 to <10.0.19044.1766
Microsoft	Microsoft Windows 10 Version 1507	10.0.10240.0 to <10.0.10240.19325
Microsoft	Microsoft Windows 10 Version 1607	10.0.14393.0 to <10.0.14393.5192
Microsoft	Microsoft Windows Server 2016	10.0.14393.0 to <10.0.14393.5192
Microsoft	Microsoft Windows Server 2016 (Server Core installation)	10.0.14393.0 to <10.0.14393.5192
Microsoft	Microsoft Windows 7	6.1.0 to <6.1.7601.25984
Microsoft	Microsoft Windows 7 Service Pack 1	6.1.0 to <6.1.7601.25984
Microsoft	Microsoft Windows 8.1	6.3.0 to <6.3.9600.20402
Microsoft	Microsoft Windows Server 2008 R2 Service Pack 1	6.1.7601.0 to <6.1.7601.25984
Microsoft	Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)	6.1.7601.0 to <6.1.7601.25984
Microsoft	Microsoft Windows Server 2012	6.2.9200.0 to <6.2.9200.23736
Microsoft	Microsoft Windows Server 2012 (Server Core installation)	6.2.9200.0 to <6.2.9200.23736
Microsoft	Microsoft Windows Server 2012 R2	6.3.9600.0 to <6.3.9600.20402
Microsoft	Microsoft Windows Server 2012 R2 (Server Core installation)	6.3.9600.0 to <6.3.9600.20402

References

3 Links

Vendor advisories

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Other references

Record Details

Published

2022-06-01

Last updated

2026-08-06

Assigner (CNA)

microsoft

Credited to

More from Microsoft

All Microsoft CVEs→

CVE-2025-592879.8 CRITICAL

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

MicrosoftKEVEPSS 100.0%2025-10-14

CVE-2021-345278.8 HIGH

Windows Print Spooler Remote Code Execution Vulnerability

MicrosoftKEVEPSS 99.8%2021-07-02

CVE-2024-214128.1 HIGH

Internet Shortcut Files Security Feature Bypass Vulnerability

MicrosoftKEVEPSS 99.4%2024-02-13

CVE-2023-368847.5 HIGH

Windows Search Remote Code Execution Vulnerability

MicrosoftKEVEPSS 98.9%2023-07-11

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.