{"id":"CVE-2022-30190","published":"2022-06-01T20:15:07Z","modified":"2026-08-06T05:16:37Z","title":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.\nPlease see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) component of Windows lets an attacker abuse the way MSDT is invoked via its URL protocol from a calling application such as Word, which is externally controllable. Exploitation requires a local attacker (per the attack vector) and user interaction, and the attacker can then run arbitrary code with the privileges of the calling application, enabling them to install programs, view, change, or delete data, or create new accounts within the user's rights.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:10:51Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99163,"percentile":0.99933,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-06-14","dueDate":"2022-07-05","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-30190","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-05-30","exploitedFirstSeen":"2022-05-30","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-May","date":"2022-05-30"},{"url":"https://cisa.gov/news-events/alerts/2022/05/31/microsoft-releases-workaround-guidance-msdt-follina-vulnerability","date":"2022-05-31"},{"url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine","date":"2022-06-13"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-06-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-14"},{"url":"https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html","date":"2022-06-30"},{"url":"https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine/","date":"2022-07-07"},{"url":"https://securelist.com/it-threat-evolution-in-q2-2022-non-mobile-statistics/107133/","date":"2022-08-15"},{"url":"https://www.fortinet.com/content/dam/maindam/PUBLIC/02_MARKETING/08_Report/report-2022-H1-threat-landscape.pdf","date":"2022-08-17"},{"url":"https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/","date":"2022-09-07"}],"evidenceTotal":58,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30190","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30190","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploit through a maliciously crafted Word document, which downloads html that then runs commands on the target machine and has been seen to download additional payloads on target machines.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-8b54b1e852454fb2c438","title":"Staying ahead of threat actors in the age of AI","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/","date":"2024-02-14","mentions":[{"quote":"LLM-assisted vulnerability research: Interacting with LLMs to better understand publicly reported vulnerabilities, such as the CVE-2022-30190 Microsoft Support Diagnostic Tool (MSDT) vulnerability (known as “Follina”).","start":12897,"end":13115}]},{"id":"SRC-aca0f297a3ae3c342a4f","title":"Woody Rat A New Feature Rich Malware Woody RAT | ThreatDown Woody RAT: A new feature-rich malware spotted in the wild","publisher":"threatdown.com","url":"https://www.threatdown.com/blog/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild/","date":"2022-08-02","mentions":[{"quote":"The threat actor is using a Microsoft Office document (Памятка.docx) that has weaponized with the Follina (CVE-2022-30190) vulnerability to drop Woody Rat.","start":1913,"end":2068}]},{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"DEV-0464 also rapidly adopted the Microsoft Support Diagnostic Tool (MSDT) vulnerability (CVE-2022-30190) in their campaigns.","start":38073,"end":38198}]},{"id":"SRC-5d2b20805459665b8dca","title":"APT44: Unearthing","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf","date":null,"mentions":[{"quote":"Variant #1\r\nA107-004 Protected Theater - APT44, COLIBRI, Execution, Variant #2\r\nA106-107 Protected Theater - APT44, Create GOGETTER Scheduled Task\r\nA107-005 Protected Theater - APT44, DARKCRYSTALRAT, Execution, Variant #1\r\nA105-346 Protected Theater - APT44, EARLYBLOOM, CVE-2022-30190, HTML Downloader,","start":106464,"end":106767}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-35396","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35396","exploited":true,"exploitedSince":"2022-06-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":81,"skipped":14,"earliest":"2022-05-30","earliestUrl":"https://github.com/JMousqueton/PoC-CVE-2022-30190","repos":[{"name":"komomon/CVE-2022-30190-follina-Office-MSDT-Fixed","url":"https://github.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed","stars":390,"created":"2022-06-02"},{"name":"JMousqueton/PoC-CVE-2022-30190","url":"https://github.com/JMousqueton/PoC-CVE-2022-30190","stars":158,"created":"2022-05-30"},{"name":"onecloudemoji/CVE-2022-30190","url":"https://github.com/onecloudemoji/CVE-2022-30190","stars":104,"created":"2022-05-31"},{"name":"doocop/CVE-2022-30190","url":"https://github.com/doocop/CVE-2022-30190","stars":60,"created":"2022-05-31"},{"name":"Malwareman007/Deathnote","url":"https://github.com/Malwareman007/Deathnote","stars":38,"created":"2022-06-08"}]},"metasploit":[{"name":"Microsoft Office Word MSDTJS","module":"exploit/windows/fileformat/word_msdtjs_rce","type":"exploit","disclosureDate":"2022-05-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/word_msdtjs_rce.rb"}],"first":{"date":"2022-05-29","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/word_msdtjs_rce.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE","id":"ec8c4047-fad9-416a-8c81-0f479353d7f6","level":"high","status":"test","path":"rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml","techniques":["T1202"]},{"title":"File Creation In Suspicious Directory By Msdt.EXE","id":"318557a5-150c-4c8d-b70e-a9910e199857","level":"high","status":"test","path":"rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml","techniques":["T1547.001"]}]},"exploitRefs":["http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"},{"date":"2022-05-29","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-05-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/word_msdtjs_rce.rb","provenance":"source"},{"date":"2022-05-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-May","provenance":"source"},{"date":"2022-06-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30190","provenance":"source"},{"date":"2022-06-14","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35396","provenance":"source"},{"date":"2022-08-02","kind":"report","label":"Named in threatdown.com: Woody Rat A New Feature Rich Malware Woody RAT | ThreatDown Woody RAT: A new feature-rich malw…","url":"https://www.threatdown.com/blog/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild/","provenance":"machine"},{"date":"2024-02-14","kind":"report","label":"Named in microsoft.com: Staying ahead of threat actors in the age of AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":13},"priority":{"score":87.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1613 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 81 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}