CVE-2022-30216: Windows Server Service tampering via unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with a very high EPSS percentile and network reachability make this a serious patching priority despite no KEV listing.

What it is

CVE-2022-30216 is a tampering vulnerability in the Windows Server Service, classified as CWE-434 (unrestricted file upload). The record gives only a one-line description, so the exact mechanism is not documented here, but the CVSS vector indicates a network-reachable flaw that a low-privileged user can trigger to fully compromise confidentiality, integrity and availability.

Impact

An attacker with low privileges can tamper with the affected service, gaining high impact to confidentiality, integrity and availability on the target host. In practice this could mean code execution or service manipulation on a Windows system.

Attack surface

Reached over the network (AV:N) with low complexity and no user interaction, but it requires a low-privileged authenticated account (PR:L). No public exploit detail is present in the record.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high at 0.889 (99.8th percentile), suggesting elevated likelihood of exploitation activity. The two references are both the Microsoft update guide with no exploit tags.

What to do

• Apply the Microsoft security update for CVE-2022-30216 on all affected Windows 10, Windows 11, Windows Server 2016 and Windows Server 2022 systems.
• Restrict network access to the Server service (SMB/port 445) to trusted hosts and segments.
• Enforce least privilege and review accounts with local logon or service access on servers.
• Monitor for unexpected file writes or service configuration changes on Windows hosts.

Detection

• Alert on unexpected modifications to Server service binaries, configuration or registry keys.
• Monitor for new or modified files in service-related directories on Windows hosts.
• Correlate low-privileged account activity with SMB traffic to server hosts.
• Track Microsoft update compliance for the affected Windows builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.