Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Microsoft Windows Server 2019 (Server Core installation)
Status
Versions
Affected
from 10.0.17763.0 to before 10.0.17763.3046
Microsoft Windows 10 Version 21H1
Status
Versions
Affected
from 10.0.0 to before 10.0.19043.1766
Microsoft Windows Server 2022
Status
Versions
Affected
from 10.0.20348.0 to before 10.0.20348.770
Microsoft Windows 10 Version 20H2
Status
Versions
Affected
from 10.0.0 to before 10.0.19042.1766
Microsoft Windows Server version 20H2
Status
Versions
Affected
from 10.0.0 to before 10.0.19042.1766
Microsoft Windows 11 version 21H2
Status
Versions
Affected
from 10.0.0 to before 10.0.22000.739
Microsoft Windows 10 Version 21H2
Status
Versions
Affected
from 10.0.19043.0 to before 10.0.19044.1766
Microsoft Windows 10 Version 1507
Status
Versions
Affected
from 10.0.10240.0 to before 10.0.10240.19325
Microsoft Windows 10 Version 1607
Status
Versions
Affected
from 10.0.14393.0 to before 10.0.14393.5192
Microsoft Windows Server 2016
Status
Versions
Affected
from 10.0.14393.0 to before 10.0.14393.5192
Microsoft Windows Server 2016 (Server Core installation)
Status
Versions
Affected
from 10.0.14393.0 to before 10.0.14393.5192
Microsoft Windows 7
Status
Versions
Affected
from 6.1.0 to before 6.1.7601.25984
Microsoft Windows 7 Service Pack 1
Status
Versions
Affected
from 6.1.0 to before 6.1.7601.25984
Microsoft Windows 8.1
Status
Versions
Affected
from 6.3.0 to before 6.3.9600.20402
Microsoft Windows Server 2008 R2 Service Pack 1
Status
Versions
Affected
from 6.1.7601.0 to before 6.1.7601.25984
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
Status
Versions
Affected
from 6.1.7601.0 to before 6.1.7601.25984
Microsoft Windows Server 2012
Status
Versions
Affected
from 6.2.9200.0 to before 6.2.9200.23736
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Summary: CISA's KEV catalog, as of .
CISA added CVE-2022-30190 to its Known Exploited Vulnerabilities (KEV) catalog on 14 Jun 2022.
It is widely known as Follina, a common name that is not used in the CVE record or in CISA's catalog.
CISA marks it as known to be used in ransomware campaigns.
The due date CISA sets for the required action is 5 Jul 2022.
The CVE record was published on 1 Jun 2022, 13 days before it was added to KEV.
The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99.2% (percentile 99.9), as of 28 Oct 2026.
CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.