Microsoft Patches Follina Zero-Day: What Windows Users Should Do

Last updated: October 13, 2026

Microsoft shipped security updates in its June 2022 Patch Tuesday that finally address Follina, the actively exploited zero-day that abuses the Microsoft Support Diagnostic Tool. The flaw, tracked as CVE-2022-30190, has been used in real attacks since at least mid-April.

There is a wrinkle. Installing the patch does not, by itself, seal the hole. As vulnerability analyst Will Dormann noted, a registry setting called TurnOffCheck can re-expose a fully patched machine to the same bug. Microsoft left that escape hatch open for customers who rely on the older MSDT behaviour—which means some admins may accidentally undo their own security work.

Who should care

Home users with auto-updates on:** Low risk. Your system patched itself. Just verify the June update landed and move on.

IT admins managing Office fleets:** High priority. The TurnOffCheck registry value is the trap here. Organizations that follow Microsoft's hardening guides sometimes set this to keep MSDT in a legacy state, inadvertently re-opening the Follina door on fully patched machines.

Security teams at government agencies:** Active concern. US and EU government agencies were directly targeted in the second wave of Follina attacks, and the most recent campaigns link to Qbot malware distribution.

Small businesses without dedicated IT:** Moderate risk. Phishing emails carrying Follina payloads look like normal Word attachments—no macro warnings, no suspicious filenames. Staff training on unexpected document handling is your patch.

How Follina works

The bug exploits MSDT, a tool designed to help Microsoft support diagnose crashes. By crafting a malicious Office document that calls MSDT improperly, attackers can run arbitrary code on the victim's machine. They can then install software, add user accounts, and tamper with files.

What makes it dangerous is the delivery method. A user only needs to open a weaponised Word document. There is no macro prompt, no suspicious executable—just a file that looks legitimate. Security firm Proofpoint documented the full attack chain.

Our analysis

The gap between discovery and fix is the real story. Researchers flagged Follina in late May. Microsoft initially offered a Command Prompt workaround instead of a patch—and reportedly told at least one researcher who reported the issue that it was not a security concern. Meanwhile, attacks had been running for at least a month. That window is where victims get burned.

The TurnOffCheck quirk is the part most users will overlook. It exists because some enterprise customers genuinely need MSDT to behave in older ways, but it creates a landmine for anyone who applied hardening guidance without understanding the trade-off. Admins: audit this value before you assume the patch has you covered.

The broader pattern is predictable: a built-in diagnostic tool gets weaponised, Microsoft patches it, attackers pivot. Expect continued MSDT-style abuse until Microsoft restricts how Office apps invoke system utilities by default. Until then, this class of vulnerability will recur.

What to watch

Watch whether attackers start chaining Follina with Qbot—the latest reported campaigns already pair them. Watch for a hardening guide that finally retires MSDT as a default Office dependency. And audit TurnOffCheck now, not later.

Key takeaways

• The June 2022 update fixes Follina, but the TurnOffCheck registry value can re-expose patched systems.
• Follina is dangerous because it triggers through normal Word documents without macro warnings.
• Attackers used geopolitical bait initially; recent campaigns target organisations via Qbot phishing.
• Auto-update users are protected but should verify the patch landed. Admins must audit TurnOffCheck.