Cyber Resilience

CVE-2022-30136

Microsoft Windows Server 2012 r2

High EPSS
Published
15 June 2022
Modified
02 January 2025
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.78 99.5th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2022-30136 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-30136 is a remote code execution vulnerability in the Windows Network File System (NFS) component. It affects multiple versions of Windows that implement NFS services and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require neither authentication nor user interaction.

An unauthenticated attacker can send specially crafted NFS traffic to a vulnerable system and achieve arbitrary code execution with the privileges of the NFS service, resulting in full compromise of confidentiality, integrity, and availability on the target host.

Microsoft security advisories for CVE-2022-30136 direct administrators to apply the vendor-supplied security updates released on the June 2022 Patch Tuesday; the updates address the flaw in the NFS driver and related components.

The CVE’s EPSS score reached a peak of 0.4339 and currently stands at 0.3778, indicating sustained but moderate exploitation interest after disclosure.

EU & UK References

Vulnerability Data

Windows Network File System Remote Code Execution Vulnerability

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated remote code execution via crafted NFS traffic directly enables exploitation of a public-facing network service.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Arbitrary code execution with NFS service privileges results in privilege escalation on the target host.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movementconfidence: HIGH
The vulnerability allows exploitation of the Windows NFS remote service to achieve code execution.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-0610Same product: Microsoft Windows Server 2012
CVE-2020-0609Same product: Microsoft Windows Server 2012
CVE-2024-30070Same product: Microsoft Windows Server 2012
CVE-2023-35331Same product: Microsoft Windows Server 2012
CVE-2023-35638Same product: Microsoft Windows Server 2012
CVE-2023-28223Same product: Microsoft Windows Server 2012
CVE-2023-29369Same product: Microsoft Windows Server 2012
CVE-2024-37979Same product: Microsoft Windows Server 2012
CVE-2023-35352Same product: Microsoft Windows Server 2012
CVE-2018-8476Same product: Microsoft Windows Server 2012

Affected Assets

microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions
microsoft
windows server 2019
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-7 Least Functionality
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires applying the vendor security update that patches the NFS driver flaw before unauthenticated RCE can occur.

CM-7 Least Functionality good match
prevent

Enforces disabling or restricting the NFS service when not required, eliminating the attack surface for crafted remote traffic.

SC-7 Boundary Protection partial match
prevent

Boundary protection can block or limit NFS traffic from untrusted networks, reducing the network-accessible vector described in the CVE.

References