Follina — Microsoft Windows Support Diagnostic Tool Remote Code Execution
A remote-code-execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) allows an attacker to execute arbitrary code when a malicious Office document is opened — triggered via a remote template reference that invokes MSDT through the ms-msdt URI scheme, without requiring macros.
- Vendor
- Microsoft
- Product
- Windows Support Diagnostic Tool (MSDT)
- CVSS
- 7.8
- EPSS (exploit probability)
- 98.5%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2022-30190 being exploited?
Yes. CISA added CVE-2022-30190 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 98.5% (scored November 12, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2022-30190 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2022-30190, nicknamed “Follina” by the researcher who first drew public attention to it, is a remote-code-execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). It was publicly disclosed on May 30, 2022, days after independent researchers spotted an in-the-wild malicious Word document exploiting it — Microsoft confirmed active exploitation at disclosure.
Why it mattered
The exploit technique was notable for what it didn’t need: no macros, no user interaction beyond opening (or in some configurations even just previewing) a document. A Word file referencing a remote HTML template could invoke the ms-msdt: URI handler to run arbitrary PowerShell, sidestepping the macro-blocking defenses many organizations had spent years rolling out in response to earlier document-based malware campaigns.
Microsoft’s interim guidance — disabling the MSDT URL protocol handler via a registry change — was published before the full patch and was widely adopted as an emergency stopgap. The bug was added to the KEV catalog. Full mitigation and patch guidance is in Microsoft’s security advisory and at the NVD link above.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | [ MEDIUM ] | 6.5 | 1.6% | |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% |
