CVE-2022-30136
Microsoft Windows Server 2012 r2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-30136 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-30136 is a remote code execution vulnerability in the Windows Network File System (NFS) component. It affects multiple versions of Windows that implement NFS services and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require neither authentication nor user interaction.
An unauthenticated attacker can send specially crafted NFS traffic to a vulnerable system and achieve arbitrary code execution with the privileges of the NFS service, resulting in full compromise of confidentiality, integrity, and availability on the target host.
Microsoft security advisories for CVE-2022-30136 direct administrators to apply the vendor-supplied security updates released on the June 2022 Patch Tuesday; the updates address the flaw in the NFS driver and related components.
The CVE’s EPSS score reached a peak of 0.4339 and currently stands at 0.3778, indicating sustained but moderate exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35344
Vulnerability Data
Windows Network File System Remote Code Execution Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.