Follina

Expanded Definition

Follina is the widely used name for CVE-2022-30190, a Microsoft Windows remote code execution flaw that is triggered through Microsoft Office content and the Windows MSDT diagnostic path. It matters because the document itself can become the delivery mechanism, which blurs the line between a simple file opening event and code execution on the endpoint.

The term is usually used in the context of initial access, where a malicious document references a remote template or other external content and then causes MSDT to run with attacker-influenced parameters. That makes Follina different from a generic macro threat or a normal document exploit: the abuse sits in a platform trust path rather than in user-written script. For practitioners, the common boundary mistake is treating it as “just another Office issue” rather than a Windows execution chain that may bypass expectations about macro settings.

Guidance vs consensus: there is broad agreement that Follina is a document-driven remote code execution issue, but public discussion has varied on how to classify the exact exploit chain because the payload delivery and trigger mechanics can differ by document type and environment.

Examples and Use Cases

Follina appears in practical security work when teams investigate suspicious Office documents, internet-delivered attachments, or endpoint alerts showing a child process launched from an Office application. It is also relevant when a SOC needs to distinguish a benign template retrieval from a crafted chain designed to activate MSDT.

• A user opens a weaponised document from email, and the file silently pulls remote content before execution is triggered.
• An analyst reviews process telemetry and finds Office spawning a diagnostic utility or a command interpreter in a way that does not match normal business use.
• A detection engineer writes logic to flag documents that reference external templates, especially when the document also produces unusual child process activity.
• An incident responder uses the exploit chain to explain why a single file can create both user interaction and code execution in the same event path.
• A defender compares Follina with macro-based attacks to understand that blocking macros alone does not eliminate all document-based initial access paths.

The tradeoff is that tightly restricting external content and related Office behaviours can reduce exposure, but it can also affect legitimate document workflows that depend on trusted template retrieval or embedded content.

Security Implications

Follina is dangerous because it turns routine document handling into a potentially executable event. That raises the impact of email phishing, web download abuse, and partner document exchange, since the attacker does not need to start with a live account or an installed payload on disk.

The failure mechanism is a trust mismatch: Office content is allowed to interact with an external resource, and the resulting chain reaches a Windows diagnostic pathway that the user did not intentionally invoke. When organisations misclassify the risk, they may over-rely on macro controls, overlook document sandboxing, or miss the significance of a document that generates network access before a visible alert.

The concrete consequence is endpoint compromise through a single interaction, followed by whatever the delivered payload enables next, including credential theft, persistence, or internal recon activity. In practice, suspicious Office documents that also create unusual network and process activity deserve higher priority than ordinary attachment review because the blast radius extends beyond the file itself.

Domain and Governance Relevance

Follina belongs primarily to Windows endpoint security, email security, and exploit mitigation, not to identity governance by default. Its governance relevance comes from how organisations control document execution paths, patch vulnerable client software, and decide which inbound file behaviours are acceptable in the business environment.

For identity and access teams, the useful intersection is indirect but real: a document-driven initial access event often becomes the starting point for token theft, account misuse, or lateral movement after the endpoint is compromised. That means the term is relevant to incident scoping, privilege containment, and account recovery planning, even though the exploit itself is not an identity problem.

From a policy perspective, Follina is a reminder that security ownership must span email filtering, endpoint hardening, user workflow exceptions, and vulnerability management. A control that only focuses on one layer can leave the execution path intact.