CVE-2022-30190

This vulnerability is like a “help” feature (MSDT) that can be tricked into opening a door from another program (for example, a document or message). If an attacker gets you to click or open something that triggers it, they may be able to run commands on your computer as whatever user rights the tricked program has. Think of it as turning a support hotline into a backdoor—once the trap is triggered, the attacker can take actions on your device.

This matters to you if your business uses the affected Microsoft Windows versions: microsoft windows 10 1507, microsoft windows 10 1607, microsoft windows 10 1809, microsoft windows 10 20h2, microsoft windows 10 21h1, microsoft windows 10 21h2, microsoft windows 11 21h2, microsoft windows 7, microsoft windows 8.1, or microsoft windows rt 8.1. The risk is higher if your staff open email attachments or documents from the internet (for example, Microsoft Word files).

This is urgent because it is already being exploited in the wild, including in ransomware, and there is public exploit code available. With the estimated exploitation likelihood being extremely high in the next 30 days, you should treat this as an active attack threat and prioritize fixing it now rather than waiting.

1. Identify exposure: confirm which machines run the affected Windows versions (microsoft windows 10 1507, 1607, 1809, 20h2, 21h1, 21h2, microsoft windows 11 21h2, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1).

2. Patch first: install the Microsoft security updates that address CVE-2022-30190 on every affected device. Restart machines after patching if required.

3. Apply Microsoft’s mitigation steps: if a device can’t be fully patched right away, apply the recommended protection to stop MSDT being invoked via the URL protocol from calling applications (this is the core trigger described). Have your IT provider follow Microsoft’s MSRC Blog Entry and implement the specific setting/blocking recommended there.

4. Reduce phishing-trigger risk: tighten email security and user behavior temporarily—block or quarantine suspicious attachments, and instruct staff not to open unsolicited Word documents or “help” content from unknown senders.

5. Monitor after changes: check for any indicators that suspicious activity occurred around the time of the trigger (for example, unusual account changes or newly installed software). If you use endpoint logging/monitoring, look for process executions that follow document opening.

6. Validate: test that the mitigation is effective (your IT provider can verify that MSDT invocation through that URL path is no longer possible) and confirm updates are installed on all machines, including any remote devices and file servers users rely on.

Severity and likelihood: CVE-2022-30190 is rated HIGH (CVSS 7.8 in the provided context) with very high exploitation probability (EPSS 99.4%). It is listed in CISA KEV and marked as known exploited in the wild (used in ransomware), with public exploit availability and “itw” exploitation status from press.

Affected software: MSDT on Microsoft Windows versions listed in the provided context: microsoft windows 10 1507, 1607, 1809, 20h2, 21h1, 21h2, microsoft windows 11 21h2, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1.

Weakness type and attack vector: a remote code execution issue where MSDT is called using the URL protocol from a calling application such as Word. Successful exploitation lets the attacker execute arbitrary code with the privileges of the calling application (and therefore the user context at the time of triggering).

Exploitation flow (as described): attacker triggers MSDT via the URL protocol from another application → code execution occurs → attacker can install software, view/change/delete data, or create new accounts within the allowed user rights.

Detection context: a Nuclei detection template exists as “no” in the provided context, so signature-based detection may be more limited. What “EPSS/KEV” mean here: KEV indicates it’s been confirmed as a known actively exploited vulnerability; EPSS is an estimate of how likely exploitation is in a given time window—here extremely high, aligning with urgent action.