What is CVE-2022-30190 (Follina) and how does it impact Microsoft Office users?

CVE-2022-30190, also known as Follina, is a high-severity remote code execution (RCE) vulnerability affecting Microsoft Office. It exploits the Microsoft Support Diagnostic Tool (MSDT) via the ms-msdt:// protocol, allowing attackers to execute malicious PowerShell code through macro-less Word documents, even in protected view. This vulnerability enables attackers to install programs, modify or delete data, or create new accounts within the user's rights. It impacts Office 2013, 2016, 2019, 2021, Office Pro Plus, and Office 365. Microsoft guidance recommends disabling the MSDT URL protocol to mitigate risk.

What is the recommended mitigation for CVE-2022-30190?

Microsoft recommends disabling the MSDT URL protocol to prevent attackers from exploiting CVE-2022-30190. Applying the published workarounds and validating their effectiveness is crucial for protection.

How does CVE-2022-30190 exploit macro-less Word documents?

The Follina vulnerability allows attackers to activate MSDT from regular .docx or .rtf documents without macros, and even when opened in protected view. It also works on shared .docs files, enabling malicious code execution via the ms-msdt protocol.

Which versions of Microsoft Office are affected by CVE-2022-30190?

CVE-2022-30190 affects Office 2013, 2016, 2019, 2021, Office Pro Plus, and Office 365. Any network user is a potential victim until mitigations are applied and validated.

How can I locally test for the Follina Office RCE vulnerability?

A proof-of-concept (PoC) for locally testing CVE-2022-30190 is available on GitHub. This tool helps organizations verify their exposure to the vulnerability.

What resources does Cymulate offer for validating against CVE-2022-30190?

Cymulate offers a purple team scenario, Immediate Threat Intelligence kit, and SIEM signature updates for validating against CVE-2022-30190. These resources are accessible to all Cymulate users and help organizations stay ahead of emerging threats.

How quickly did Cymulate release validation scenarios for CVE-2022-30190?

Cymulate published a dedicated Immediate Threat Intelligence kit for Follina on June 1, 2022, and by June 2, users could access a purple team scenario with a production-safe payload for validation.

Can Cymulate help update SIEM signature banks with IoCs for CVE-2022-30190?

Yes, Cymulate users can update their SIEM signature banks with multiple Indicators of Compromise (IoCs) related to CVE-2022-30190, enhancing detection and response capabilities.

What is the role of the ms-msdt protocol in CVE-2022-30190 exploitation?

The ms-msdt protocol enables remote execution of diagnostic tools via Microsoft Support. In CVE-2022-30190, attackers use this protocol to execute arbitrary PowerShell code through malicious documents, bypassing macro restrictions.

What customer feedback has Cymulate received regarding ease of use?

Cymulate is consistently praised for its user-friendly and intuitive platform. Security professionals highlight its ease of implementation, actionable insights, and accessible support. For example, Raphael Ferreira, Cybersecurity Manager at Banco PAN, stated, 'Cymulate is easy to implement and use—all you need to do is click a few buttons, and you receive a lot of practical insights into how you can improve your security posture.'

How quickly can Cymulate be implemented in an organization?

Cymulate is designed for rapid implementation, operating in agentless mode with no need for additional hardware or complex configurations. Customers can start running simulations almost immediately after deployment. Support is available via email and chat, and educational resources help optimize usage.

What are the key capabilities of Cymulate's platform?

Cymulate offers continuous threat validation, attack path discovery, automated mitigation, detection engineering, complete kill chain coverage, and an extensive threat library with daily updates. These capabilities help organizations stay ahead of emerging risks and improve operational efficiency.

What business impact can customers expect from using Cymulate?

Customers report an 81% reduction in cyber risk within four months, a 60% increase in operational efficiency, 40X faster threat validation, 30% improvement in threat prevention, and a 52% reduction in critical exposures. Cymulate delivers measurable ROI and improved detection accuracy.

What pain points does Cymulate address for security teams?

Cymulate addresses overwhelming threat volumes, lack of visibility, unclear prioritization, operational inefficiencies, fragmented tools, cloud complexity, and communication barriers. It provides continuous threat validation, prioritization, improved resilience, collaboration, automation, and validated exposure scoring.

How does Cymulate's exposure prioritization differ from CVSS scoring?

CVSS scores indicate severity but not exploitability. Cymulate validates which exposures are actively exploitable, enabling more effective and efficient remediation.

What integrations does Cymulate support?

Cymulate integrates with a wide range of technology partners, including Akamai Guardicore (Network Security Validation), AWS GuardDuty (Cloud Security Validation), BlackBerry Cylance OPTICS, Carbon Black EDR, Check Point CloudGuard, CrowdStrike Falcon, Cybereason, and more. For a complete list, visit our Partnerships and Integrations page.

How does Cymulate differ from similar products in the market?

Cymulate offers a unified, AI-driven platform integrating breach and attack simulation (BAS), continuous automated red teaming (CART), and exposure prioritization. It provides continuous threat validation, complete kill chain coverage, ease of use, and proven results. Competitors often focus on specific areas or lack Cymulate's innovation and threat coverage.

What certifications does Cymulate hold for security and compliance?

Cymulate is certified for SOC2 Type II, ISO 27001:2013, ISO 27701, ISO 27017, and CSA STAR Level 1. It is GDPR compliant and hosted in secure AWS data centers with strong encryption and high availability.

How often does Cymulate update its threat simulation library?

Cymulate provides daily updates to its threat simulation library, ensuring customers stay ahead of emerging threats with the most advanced attack scenarios.

What educational resources does Cymulate provide?

Cymulate offers a Resource Hub, blog, glossary, webinars, and e-books covering cybersecurity best practices, threat validation, and product information.

What is Cymulate's pricing model?

Cymulate operates on a subscription-based pricing model tailored to each organization's needs. Pricing depends on the chosen package, number of assets, and scenarios selected. The subscription fee is non-refundable. For a quote, schedule a demo.

How does Cymulate compare to AttackIQ?

AttackIQ delivers automated security validation but lacks Cymulate's innovation, threat coverage, and ease of use. Cymulate offers the industry's leading threat scenario library and AI-powered capabilities to streamline workflows.

How does Cymulate compare to Mandiant Security Validation?

Mandiant is an original BAS platform but has seen little innovation in recent years. Cymulate continually innovates with AI and automation, expanding into exposure management as a grid leader.

How does Cymulate compare to Pentera?

Pentera focuses on attack path validation but lacks Cymulate's depth for full defense assessment. Cymulate offers comprehensive exposure validation, covering the full kill chain and providing cloud control validation.

How does Cymulate compare to Picus Security?

Picus is suitable for on-premise BAS needs but lacks Cymulate's complete exposure validation platform. Cymulate covers the full kill chain and includes cloud control validation, making it a more comprehensive solution.

How does Cymulate compare to SafeBreach?

SafeBreach offers breach and attack simulation but lacks Cymulate's innovation, precision, and automation. Cymulate leads with AI-powered BAS, the largest attack library, and a full Continuous Threat Exposure Management (CTEM) solution.

How does Cymulate compare to Scythe?

Scythe is suitable for advanced red teams but lacks Cymulate's focus on actionable remediation and automated mitigation. Cymulate provides a more complete exposure validation platform with daily threat updates, no-code workflows, and vendor-specific remediation guidance.

Who is the target audience for Cymulate's platform?

Cymulate serves CISOs, security leaders, SecOps teams, red teams, and vulnerability management teams across industries such as finance, healthcare, retail, media, transportation, and manufacturing.

How does Cymulate address pain points for different personas?

Cymulate tailors solutions for CISOs (communication barriers, metrics), SecOps (operational inefficiencies, visibility), red teams (threat simulation scale), and vulnerability management (risk prioritization). Each persona benefits from quantifiable metrics, automation, and actionable insights.

What technical requirements are needed to deploy Cymulate?

Cymulate operates in agentless mode, requiring minimal infrastructure. Customers must provide necessary equipment and third-party software as per Cymulate’s prerequisites. The platform integrates seamlessly into existing workflows.

What support options does Cymulate provide?

Cymulate offers email support (support@cymulate.com), real-time chat support, and access to a knowledge base with technical articles and videos. Educational resources include webinars and e-books.

Where can I find Cymulate's blog and newsroom?

For the latest threats, research, and company news, visit our blog and our newsroom.

Where can I find resources like whitepapers, product info, and thought leadership articles?

All resources, including whitepapers, product information, and thought leadership articles, are available in our Resource Hub.

Where can I find a central hub for Cymulate's insights, thought leadership, and product information?

Visit our Resource Hub for all Cymulate insights, thought leadership, and product information.

Where can I find information on the Improper Attestation Validation vulnerability in Windows Admin Center?

Cymulate has published a detailed analysis of the Improper Attestation Validation vulnerability in Windows Admin Center. Read the blog post at this link.

CVE-2022-30190, AKA Follina, Uses Macro-less Word Docs to Drop RCE Files

Last Updated: November 22, 2023

Rated a 7.8 high CVSS 3.x severity base score, CVE-2022-30190 takes advantage of the MSDT (Microsoft Support Diagnostic Tool), an official tool built in all versions of Windows. Though officially issued on May 30, 2022, CVE – 2022 – 30190 has been detected in the wild as early as April 2022, Microsoft ignored a warning from the Crazyman_Army research team that a zero-day RCE vulnerability had been detected in one of their products, and closed the vulnerability submission report than called VULN-065524, classifying it as “fixed”.

pic.twitter.com/Zr1F9wm7F3
— crazyman_army (@CrazymanArmy) May 30, 2022

Security researcher Nao_sec was credited for uncovering the vulnerability, which was reportedly discovered by nao_sec during a VirusTotal checking for files using CVE-2021-40444. CVE 2022-30190’s public disclosure took place on May 27, 2022, followed on May 30 by Microsoft’s publication of mitigation guidance. Anyone can access that tool from the Start Menu by typing MSDT in the search bar, and the opening dialog window opens up, asking for a passkey. This is because this tool is built to be used exclusively by users in communication with a Microsoft support professional who provides the passkey and uses it to remotely run diagnostic tools. The Microsoft support agent then calls the special URL protocol ms-msdt:// that enables the support agent to run the diagnostic tools on the user’s machine. These special URL protocols open the door to executing PowerShell code, enabling attackers to run malicious code on the targeted machine. Dubbed Follina, the CVE-2022-30190 vulnerability enables malicious actors to activate MSDT from a regular .docx or .rtf document even without enabled macros, and even when opened in a protected view. To make matters worse, it also works on .docs shared files. Once it passed this initial barrier to entry, attackers can turn uses the ms-msdt Microsoft Protocol URI scheme to load its code and execute its arbitrary PowerShell, granting them the power to install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.

Word to the Unwise

CVE-2022-30190 has been confirmed in Office 2013, 2016, 2019, 2021, Office Pro Plus, and Office 365. As exploits leveraging it can be activated simply through the target opening a word document, any Network user is now a potential victim until the workarounds published by Microsoft Security Response Center have been applied and, most importantly, fully validated. Microsoft guidance recommends disabling the MSDT URL protocol, effectively preventing attackers to take advantage of it for malicious purposes.

Verify Your Exposure to CVE-2022-30190

A PoC for locally testing for Follina Office RCE vulnerability can be found on Github

Which produces these results:

By the end of June 2, Cymulate users could already access a purple team scenario with an off-the-shelf, production-safe payload to validate their resilience to CVE-2022-30190. Since June 1, Cymulate already published a dedicated Immediate Threat Intelligence kit for Follina accessible to all Cymulate users.

Cymulate's Immediate threat CVE-2022-30190 kit

Cymulate users can already update their SIEM signature bank with multiple IoCs, and will soon have access to additional options to expand the breadth of purple team scenario validation.

Validate against this immediate threat, in your unique environment now.

Table of Contents

Word to the Unwise Verify Your Exposure to CVE-2022-30190

Cymulate Exposure Validation makes advanced security testing fast and easy. When it comes to building custom attack chains, it's all right in front of you in one place.

Mike Humbert, Cybersecurity Engineer

DARLING INGREDIENTS INC.

Learn More

Featured Resources

View More Resources

blog

CVE-2026-26117: Hijacking Azure Arc on Windows for Local Privilege Escalation & Cloud Identity Takeover

CVE-2026-26117 lets attackers hijack Azure Arc on Windows, escalate to SYSTEM, and seize the machine’s cloud identity.

Demo

Exposure Validation Demo

Demo of automated offensive simulations validating detection, prevention, and IOC coverage