ExploitedIn CISA KEVFix available

CVE-2022-30190

Q: Is CVE-2022-30190 actively exploited?

Yes. CVE-2022-30190 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2022-07-05.

Q: What is the CVSS score for CVE-2022-30190?

CVE-2022-30190 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Follina

Exploitation confirmed. First attested on 2022-06-14 by CISA-ADP, CISA KEV, GCVE · kevintel.

Published2022-06-01

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Timeline

dates in UTC

2022-06-0120:15CVE publishedNVD
2022-06-14Added to the CISA KEV catalogCISA KEV
2022-06-14Listed as exploited by GCVEGCVE
2022-06-14Exploitation first reportedCISA KEV
2026-08-0520:35SSVC exploitation set to activeCISA-ADP

Observed activity

isMalicious corpus · updated 2026-11-03 21:37 UTC

Indicators tagged with this CVE, per day21 indicators over 7 days

Indicator	Role	Seen	Source
b1a1dda90b3df0ba5f23430a6c55c48a9c3dbe9d	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
29d098d9ddf7e425413817089beb2eb14c91bc64	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
b22db9ccd50064cbaf5876a4a318ec8eea284585	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
947691dbba33dfeb974babcb43d3ceb7991dae29	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
1f371d032ee40e1ff115f3d463246ab92b77e640	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
178c99c6b3ad6e1e835b2325b0d9a023d61d6d64	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
7950b1730e05a2dcdd19f1a98a697798a9edbf77	—	20 h ago	MalwareBazaar - Full SHA-1 Hashes, MalwareBazaar - Full CSV (file metadata)
6a0acf2389d95abc590c8b6a327521312c4de176efce271468817c840745a096	—	20 h ago	MalwareBazaar - Full SHA-256 Hashes, MalwareBazaar - Full CSV (file metadata)
d313002804198b5af1e0b537799be348	—	20 h ago	MalwareBazaar - Full MD5 Hashes, MalwareBazaar - Full CSV (file metadata)
6878265f91c6cb31618ad8ff45891f60	—	20 h ago	MalwareBazaar - Full MD5 Hashes, MalwareBazaar - Full CSV (file metadata)

Block these indicators

Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2022-30190?format=txt
CSV export: https://api.ismalicious.com/edl/cve/CVE-2022-30190?format=csv
TAXII collection of exploited CVEs
The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD

Microsoft windows server 2012

Branch	Affected	Fixed in	Source
—	all versions	no fix published	NVD
—	= r2	no fix published	NVD

Microsoft windows 10 1507

Branch	Affected	Fixed in	Source
10.0	< 10.0.10240.19325	10.0.10240.19325	NVD

Microsoft windows 10 1607

Branch	Affected	Fixed in	Source
10.0	< 10.0.14393.5192	10.0.14393.5192	NVD

13 more products in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA23 products

As microsoft, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

Microsoft Windows 10 Version 1809
platforms: 32-bit Systems, x64-based Systems
Affected
- ≥ 10.0.17763.0, < 10.0.17763.3046fixed in 10.0.17763.3046custom
Microsoft Windows 10 Version 1809
platforms: ARM64-based Systems
Affected
- ≥ 10.0.0, < 10.0.17763.3046fixed in 10.0.17763.3046custom
Microsoft Windows Server 2019
platforms: x64-based Systems
Affected
- ≥ 10.0.17763.0, < 10.0.17763.3046fixed in 10.0.17763.3046custom
Microsoft Windows Server 2019 (Server Core installation)
platforms: x64-based Systems
Affected
- ≥ 10.0.17763.0, < 10.0.17763.3046fixed in 10.0.17763.3046custom
Microsoft Windows 10 Version 21H1
platforms: x64-based Systems, ARM64-based Systems, 32-bit Systems
Affected
- ≥ 10.0.0, < 10.0.19043.1766fixed in 10.0.19043.1766custom
Microsoft Windows Server 2022
platforms: x64-based Systems
Affected
- ≥ 10.0.20348.0, < 10.0.20348.770fixed in 10.0.20348.770custom

17 more products in the CVE record.

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of Use CVE recordupdated 2025-01-02

Fix

CISA’s required action: Apply updates per vendor instructions.due 2022-07-05

Advisories and patches

msrc.microsoft.comVendor Advisory
portal.msrc.microsoft.comPatch · Vendor Advisory

Detection

read 2026-11-02 22:42 UTC

Nuclei template: none so far
Exploit-DB: no entry
Proof-of-concept repositories: 20 repositories, unverifiedJMousqueton/PoC-CVE-2022-30190onecloudemoji/CVE-2022-301902867a0/CVE-2022-30190doocop/CVE-2022-30190archanchoudhury/MSDT_CVE-2022-30190
Metasploit modules: 1 moduleexploit/windows/fileformat/word_msdtjs_rcerank: excellentModule metadata: Metasploit Framework, © Rapid7, Inc., BSD-3-Clause.

CISA Known Exploited Vulnerability

Date Added: 2022-06-14
Patch Due Date: 2022-07-05
Ransomware Use: Known
Required Action: Apply updates per vendor instructions.

Sources

CISA KEVKEV entry2022-06-14
ENISA EUVDexploitation2022-06-142022-06-14
GCVEexploitation2022-06-14
CISA-ADPSSVC decisionactive2026-08-05
OpenCVESSVC decisionactive—
CNACVSS 3.17.8known since 2026-10-23
NVDCVSS 3.17.8read 2026-10-23
NVDCVSS 2.09.3read 2026-10-23
FIRST EPSSEPSS score99.2 %read 2026-11-02
PoC-in-GitHubproof of concept20read 2026-11-02
Metasploit FrameworkMetasploit modules1known since 2026-11-01
GitHub Advisoriesadvisory—

Identifiers

EUVD-2022-35396same flawENISA EUVD · LicenseRef-ENISA-legal-notice
GHSA-4r9q-wqcj-x85jsame flawGitHub Advisory Database · CC-BY-4.0
exploit/windows/fileformat/word_msdtjs_rceexploit moduleMetasploit Framework © Rapid7 · BSD-3-Clause

Technical details

CVSS v3 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2022-06-01
Last Modified: 2026-08-06
NVD status: Analyzed
GitHub Advisory: GHSA-4r9q-wqcj-x85j

Frequently asked questions

What is CVE-2022-30190?

Is CVE-2022-30190 actively exploited?

Yes. CVE-2022-30190 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2022-07-05.

What is the CVSS score for CVE-2022-30190?

CVE-2022-30190 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, June 2022 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

For a threat intelligence platform: malware, C2 and ransomware indicators over STIX/TAXII.
Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record

CISA KEV · CC0-1.0 (cisagov/kev-data)
CVE Program · CVE Program Terms of Use
ENISA EU Vulnerability Database · ENISA legal notice §1.2 (reproduction authorised, provided the source is acknowledged)
FIRST EPSS · EPSS terms of use (free use, attribution requested)
GCVE · GCVE dump terms (preserve source attribution)
GitHub Advisory Database · CC-BY-4.0 · GHSA-4r9q-wqcj-x85j
Metasploit Framework · BSD-3-Clause
NVD · Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms
OpenCVE · OpenCVE terms of service · terms restrict redistribution
PoC-in-GitHub · CC0-1.0
CISA Vulnrichment · CC0-1.0

MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CVE records are reproduced under the CVE Program Terms of Use: MITRE grants a perpetual, royalty-free licence to reproduce and redistribute them, provided this designation and the licence travel with every copy. Read the licence

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Sources and licences of the CVE data