CVE-2022-30146

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

High7.5EPSS 2.0%

Published: 15 Jun 2022
Updated: 2 Jan 2025
Reserved: 3 May 2022
Assigned by: microsoft

Description

Timeline

2022
3 May 2022
3 May 2022
ID reserved
By microsoft
15 Jun 202243 days later
15 Jun 2022· 43 days later
Published
2025
2 Jan 20253 years later
2 Jan 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-30146, by who scored it
Scored by	CVSS	Score	Vector
microsoftCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 2.0% · top 19% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Remote Code Execution

Affected products

Microsoft · Windows 10 Version 1809
- affected 10.0.17763.0 – < 10.0.17763.3046
Microsoft · Windows 10 Version 1809
- affected 10.0.0 – < 10.0.17763.3046
Microsoft · Windows Server 2019
- affected 10.0.17763.0 – < 10.0.17763.3046
Microsoft · Windows Server 2019 (Server Core installation)
- affected 10.0.17763.0 – < 10.0.17763.3046
Microsoft · Windows 10 Version 21H1
- affected 10.0.0 – < 10.0.19043.1766
Microsoft · Windows Server 2022
- affected 10.0.20348.0 – < 10.0.20348.770
Microsoft · Windows 10 Version 20H2
- affected 10.0.0 – < 10.0.19042.1766
Microsoft · Windows Server version 20H2
- affected 10.0.0 – < 10.0.19042.1766
Microsoft · Windows 11 version 21H2
- affected 10.0.0 – < 10.0.22000.739
Microsoft · Windows 10 Version 21H2
- affected 10.0.19043.0 – < 10.0.19043.1766
Microsoft · Windows 10 Version 1507
- affected 10.0.10240.0 – < 10.0.10240.19325
Microsoft · Windows 10 Version 1607
- affected 10.0.14393.0 – < 10.0.14393.5192
Microsoft · Windows Server 2016
- affected 10.0.14393.0 – < 10.0.14393.5192
Microsoft · Windows Server 2016 (Server Core installation)
- affected 10.0.14393.0 – < 10.0.14393.5192
Microsoft · Windows 7
- affected 6.1.0 – < 6.1.7601.25984
Microsoft · Windows 7 Service Pack 1
- affected 6.1.0 – < 6.1.7601.25984
Microsoft · Windows 8.1
- affected 6.3.0 – < 6.3.9600.20402
Microsoft · Windows Server 2008 Service Pack 2
- affected 6.0.6003.0 – < 6.0.6003.21507
Microsoft · Windows Server 2008 Service Pack 2 (Server Core installation)
- affected 6.0.6003.0 – < 6.0.6003.21507
Microsoft · Windows Server 2008 Service Pack 2
- affected 6.0.6003.0 – < 6.0.6003.21507
Microsoft · Windows Server 2008 R2 Service Pack 1
- affected 6.1.7601.0 – < 6.1.7601.25984
Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)
- affected 6.1.7601.0 – < 6.1.7601.25984
Microsoft · Windows Server 2012
- affected 6.2.9200.0 – < 6.2.9200.23736
Microsoft · Windows Server 2012 (Server Core installation)
- affected 6.2.9200.0 – < 6.2.9200.23736
Microsoft · Windows Server 2012 R2
- affected 6.3.9600.0 – < 6.3.9600.20402
Microsoft · Windows Server 2012 R2 (Server Core installation)
- affected 6.3.9600.0 – < 6.3.9600.20402

References (2)

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (opens in a new tab)vendor-advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30146 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-30146](https://trackcve.app/badge/CVE-2022-30146.svg)](https://trackcve.app/cve/CVE-2022-30146)

Record last updated 2 Jan 2025, 19:03 UTC.