- The Mess: Microsoft patched CVE-2026-69579, a critical use-after-free in Windows Message Queuing. It carries CVSS 9.8 and needs no credentials or user interaction.
- The Damage: A remote attacker can send a crafted packet to MSMQ and potentially execute code on the target.
- The Fix: Patch every system running MSMQ and check whether TCP port 1801 is unnecessarily exposed.
Windows Message Queuing is old infrastructure with a very modern problem.
CVE-2026-69579 is a use-after-free vulnerability in MSMQ’s network-facing packet processing. The official CVSS 3.1 score is 9.8 Critical, with AV:N/AC:L/PR:N/UI:N. In plain English: reachable over the network, low complexity, no authentication and no victim interaction.
That is already bad.
The interesting part is where the vulnerable service sits.
MSMQ is used by enterprise applications, middleware and legacy line-of-business systems. It is not installed by default on modern Windows, but organizations that still depend on it can have the service exposed for application messaging. CrowdStrike notes that MSMQ commonly listens on TCP port 1801 and can run with SYSTEM-level privileges.
That creates an unpleasant attack chain:
network access → malicious MSMQ packet → memory corruption → code execution
No phishing document.
No stolen password.
No user clicking “Enable Content.”
Just the service.
The bug is classified as CWE-416, Use After Free. Microsoft lists affected versions across Windows Server 2012/2012 R2, 2016, 2019, 2022 and 2025, as well as multiple Windows client releases. Patched builds were released as part of the September 2026 security updates.
And this is not MSMQ’s first serious problem.
ZDI’s September review lists additional MSMQ vulnerabilities, including another RCE from the same update cycle. Earlier this year, MSMQ also received patches for critical RCE bugs.
That history makes the service worth auditing instead of blindly patching and forgetting.
If MSMQ is required, patch it.
If it is not required, remove or disable it.
And if TCP/1801 is reachable from networks that do not need access to the messaging infrastructure, block it.
A forgotten legacy messaging service should not become an attacker’s remote code execution endpoint.
Bugstoday Opinion
MSMQ is exactly the kind of Windows component attackers love.
It is old. It is often deployed because some critical business application still depends on it. And administrators may not remember that it is sitting there listening for network traffic.
A 9.8 unauthenticated RCE on such a service is not just another Patch Tuesday number.
Find the MSMQ servers. Find port 1801. Patch them.
Before someone else finds them first.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security Response Center
National Vulnerability Database
CrowdStrike
Zero Day Initiative
