CVE-2022-30136: Windows Network File System remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score make this a top patching priority despite the thin technical detail.

What it is

CVE-2022-30136 is a remote code execution flaw in the Windows Network File System (NFS) service. It is network reachable with no privileges or user interaction required, and the CVSS 3.1 base score is 9.8 (critical). The record gives no root-cause detail beyond the generic description and an uninformative CWE entry.

Impact

A successful attacker can execute arbitrary code on the affected server, which given the network-facing service can lead to full compromise of the host. The record does not state the privilege level the code runs at.

Attack surface

Reached over the network via the NFS service on affected Windows Server versions; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed. The record does not specify which port or protocol version is involved.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.73206 (99.4th percentile), indicating a high modeled likelihood of exploitation. The only references are Microsoft advisories tagged Mitigation, Patch and Vendor Advisory; no public exploit reference is provided.

What to do

• Apply the Microsoft security update for CVE-2022-30136 on all affected Windows Server 2012, 2016 and 2019 hosts as the first action.
• If NFS is not required, disable or uninstall the NFS server role and related services.
• Restrict network access to NFS ports to trusted hosts and segments using host and network firewalls.
• Follow the mitigation guidance in the Microsoft advisory for hosts that cannot be patched immediately.
• Inventory all servers running the NFS role so patching and exposure checks are complete.

Detection

• Monitor for unexpected crashes or restarts of the NFS service and related Windows error reporting events on servers running the role.
• Alert on anomalous inbound connections to NFS service ports from untrusted or external sources.
• Hunt for suspicious child processes spawned by the NFS service or SYSTEM-level processes on NFS servers.
• Track patch state of the NFS role across the server estate and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.