EXPOSURES › CVE-2022-30190
CVE-2022-30190
CRITICAL ⌖ ON CISA KEV · EXPLOITEDAn unpatched RCE flaw in Microsoft's Windows Support Diagnostic Tool allowed attackers to execute arbitrary code via URL protocol calls from applications like Word.
The MSDT vulnerability (CVE-2022-30190) was actively exploited in the wild and linked to ransomware attacks, enabling remote code execution with the privileges of the calling application. DIB organizations must ensure this CVE is patched and monitor for exploitation attempts, as it represents a negligent failure to address a known, high-severity vulnerability that directly impacts compliance with NIST 800-171 and CMMC requirements for patch management and vulnerability mitigation.
Shame score — Microsoft failed to patch a critical RCE vulnerability in a widely used diagnostic tool, which was actively exploited in the wild and linked to ransomware, demonstrating severe negligence and avoidable risk.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |