CVE-2026-69579: Windows Message Queuing Use After Free

CVE-2026-69579 Overview

CVE-2026-69579 is a use-after-free vulnerability [CWE-416] in the Windows Message Queuing (MSMQ) service. An unauthenticated attacker can trigger the flaw over the network to execute arbitrary code in the context of the vulnerable service. The vulnerability requires no user interaction and no prior privileges, making it reachable by any attacker capable of sending crafted packets to an exposed MSMQ endpoint.

Microsoft published details in the Microsoft Security Update Guide. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Unauthenticated remote code execution against Windows systems running the Message Queuing service, typically on TCP port 1801.

Affected Products

Windows Message Queuing (MSMQ) service on supported Windows platforms
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Systems with the Message Queuing Windows feature enabled

Discovery Timeline

2026-09-08 - CVE-2026-69579 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-69579

Vulnerability Analysis

The flaw is a use-after-free condition in the Windows Message Queuing service. Use-after-free bugs occur when a program continues to reference memory after that memory has been freed. An attacker who controls the layout of the freed region can influence subsequent reads or writes to hijack control flow.

Because MSMQ processes messages received from the network, an attacker can send a crafted sequence of packets to trigger the dangling reference. Successful exploitation yields code execution in the security context of the MSMQ service, which typically runs with elevated privileges on Windows hosts.

Root Cause

The root cause is improper object lifetime management inside MSMQ message handling code. A code path releases a heap object while another code path retains and later dereferences a pointer to the same object. This class of defect is tracked as [CWE-416]. Consult the Microsoft Security Update Guide for component-level details.

Attack Vector

Attackers deliver malicious MSMQ packets to a listening endpoint, most commonly TCP port 1801. No authentication or user interaction is required. Hosts that expose MSMQ to untrusted networks, including the internet, are the highest priority targets. Internal segments are also at risk from lateral movement once a foothold is established.

No verified exploit code is publicly available at the time of writing. Refer to Microsoft's advisory for further technical detail.

Detection Methods for CVE-2026-69579

Indicators of Compromise

Unexpected inbound TCP connections to port 1801 from untrusted networks or unusual internal hosts
Crashes, restarts, or memory faults involving the mqsvc.exe process
Child processes spawned by mqsvc.exe such as cmd.exe, powershell.exe, or rundll32.exe
New service installations, scheduled tasks, or outbound C2 connections originating shortly after MSMQ activity

Detection Strategies

Inventory Windows systems where the Message Queuing feature is installed and enabled, and flag any with port 1801 exposed to untrusted networks
Alert on process lineage anomalies where mqsvc.exe spawns interactive shells or script interpreters
Correlate Windows Error Reporting events for MSMQ faults with subsequent authentication or persistence events on the same host

Monitoring Recommendations

Collect Sysmon process creation, network connection, and image load events from all servers running MSMQ
Monitor firewall and NetFlow telemetry for external sources connecting to TCP 1801
Track patch state of the MSMQ component across the fleet and alert on hosts missing the fix

How to Mitigate CVE-2026-69579

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing allows
Block inbound TCP 1801 at perimeter and internal firewalls except where MSMQ is explicitly required
Disable the Message Queuing Windows feature on hosts that do not require it

Patch Information

Microsoft has issued a security update addressing CVE-2026-69579. Administrators should consult the Microsoft Security Update Guide to identify the specific KB article and build number for each affected Windows release, then deploy through their standard patch management process.

Workarounds

Remove the Message Queuing optional Windows feature on hosts that do not use MSMQ
Restrict TCP port 1801 to a defined allowlist of application servers using host and network firewalls
Place MSMQ endpoints behind network segmentation and require authenticated VPN access for administrative reachability

bash

# Disable the Message Queuing feature on Windows Server (PowerShell)
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart

# Block inbound TCP 1801 at the host firewall
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" \
  -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block