CVE-2022-30190 is a Microsoft Windows vulnerability in the Support Diagnostic Tool, often called Follina. A crafted file or link can trigger remote code execution when the tool processes malicious content, allowing attackers to run code with the victim’s privileges and potentially expand access across systems.
What CVE-2022-30190 Means in Practice
CVE-2022-30190 is a Windows remote code execution issue in the Support Diagnostic Tool, often called Follina. The core danger is that a crafted file or link can trigger code execution during normal content processing, turning a document-handling workflow into an execution path.
For a vulnerability like this, the important security point is not just that code can run, but that the trigger can arrive through ordinary user interaction. That makes the issue especially relevant in environments where staff open externally supplied documents, follow embedded links, or handle files from email, chat, ticketing, or web download flows.
Why This Vulnerability Class Is Dangerous
Remote code execution in a widely used Windows component is dangerous because it can move an attacker from initial delivery into active control with the victim’s privileges. Once execution happens, the attacker may be able to launch additional tooling, harvest local data, or prepare follow-on access depending on the account context and endpoint controls in place.
This class of flaw is also risky because it can be used as a low-friction entry point into broader intrusion chains. A single successful execution event may be enough to establish persistence, stage additional payloads, or create the conditions for lateral movement if endpoint hardening and identity controls are weak.
When discussing exploitability, readers should rely on the vendor advisory and the CVE Program record for the canonical vulnerability identity, and on the NIST National Vulnerability Database for the associated record and reference material.
How Organisations Check Exposure
Exposure analysis starts with knowing where the affected tool or related Windows components exist, which systems receive untrusted documents, and which business workflows allow externally sourced content to be opened. Asset inventory matters here because the vulnerable path is often embedded in a normal desktop or server workflow rather than in a single isolated application.
Security teams should also look at internet exposure and delivery paths. If the organisation relies on email gateways, web filtering, browser download controls, or file-sharing platforms, the question is whether malicious content can still reach a user in a form that can invoke the vulnerable processing chain.
The most useful operational reference for this kind of triage is NHIMG’s Vulnerability Management Guide, because it covers asset scope, KEV-based prioritisation, remediation SLAs, exceptions, and verification.
Remediation, Detection, and Post-Compromise Review
The preferred response is to apply the vendor’s remediation guidance as soon as practical and to use compensating controls until patching or mitigation is complete. Where immediate remediation is not possible, organisations should reduce exposure by tightening document handling paths, limiting execution from untrusted content sources, and reducing the blast radius of interactive user sessions.
Detection should focus on signs that the vulnerable path has already been used. That includes unusual child processes, unexpected command execution from document or diagnostic tool activity, suspicious downloads, and any evidence that the initial execution was followed by payload staging or persistence.
After remediation, review the endpoint for follow-on compromise rather than assuming the issue ended with patching. If the exploit was successful, credentials, tokens, or active sessions associated with the affected account may need review or rotation depending on what the attacker could access after execution.
For broader remediation patterns around exploited vulnerabilities and stolen access material, the State of NHI & AI Agent Breach Report 2026 is useful because it shows how attackers commonly pair initial execution with credential theft and lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | RCE via crafted content directly calls for malicious code prevention and inspection controls. |
| SI-4 — System Monitoring | Post-exploitation review depends on detecting unusual execution and follow-on activity. | |
| CM-7 — Least Functionality | Reducing what can execute from user-driven content lowers the exploit blast radius. | |
| Recommendation — Strengthen SI-3 to block malicious content before it can execute on the endpoint. Use SI-4 to detect abnormal process creation, payload staging, and persistence after exploitation. Apply CM-7 to remove unnecessary execution paths and limit what users can launch. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | The vulnerability is exploitable through malicious content and therefore aligns with malware defense safeguards. |
| Recommendation — Deploy CIS-10 safeguards to prevent, contain, and monitor malicious payload execution. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | The term concerns an exploitation path created by unsafe content processing and trust boundaries. |
| Recommendation — Use V15 to design away unsafe content-processing paths that can lead to code execution. | ||
| MITRE ATT&CK | T1204 — User Execution | Crafted files and links rely on user action to trigger the malicious code path. |
| Recommendation — Map delivery and trigger events to T1204 and hunt for user-driven execution of malicious content. | ||
Practitioner Guidance
Why practitioners should care: Follina-style exploitation is dangerous because the delivery method can look routine, yet the impact can be immediate code execution on an endpoint. Treat user-facing content paths as security boundaries, not just productivity features.
What to watch for: The key operational question is whether your environment can still turn a benign-looking file or link into code execution before detection or containment intervenes. Pay special attention to systems that process externally supplied content and to user populations that routinely handle untrusted documents.
Practitioner takeaway: The right mental model is exploit chain, not isolated file format. The vulnerability becomes materially worse when document handling, execution permission, and post-exploitation visibility are all weak at the same time.
Related resources from NHI Mgmt Group
- How should security teams reduce risk from CVE-2022-30190 in managed Windows environments?
- Why does CVE-2022-30190 create such high risk for Windows environments?
- Is CVE-2022-30190 (Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution) being exploited in the wild?
- How do you patch or mitigate CVE-2022-30190 (Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution)?