CVE-2026-85859: Windows Message Queuing DOS Vulnerability

CVE-2026-85859 Overview

CVE-2026-85859 is a null pointer dereference vulnerability [CWE-476] in the Windows Message Queuing (MSMQ) Queue Manager. An authorized attacker can send crafted network traffic to the Queue Manager and trigger a dereference of a null pointer, causing the service to crash. The flaw affects availability only; it does not expose confidential data or allow modification of system state. Microsoft published the advisory on October 13, 2026 and tracks remediation through the Microsoft Security Response Center.

Critical Impact
An authenticated remote attacker can crash the Windows Message Queuing service, disrupting applications and workflows that depend on asynchronous message delivery.

Affected Products

Microsoft Windows (Message Queuing Queue Manager component)
Systems with the MSMQ role or feature enabled
Refer to the Microsoft Security Update CVE-2026-85859 advisory for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85859 published to the National Vulnerability Database
2026-10-13 - Microsoft publishes the security update guidance
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-85859

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing Queue Manager, the component that routes and persists MSMQ messages between endpoints. The Queue Manager accepts network input and processes it before validating that specific internal pointers reference allocated structures. When those structures are absent, the service dereferences a null pointer and terminates. Because MSMQ underpins asynchronous inter-process and inter-host messaging, a service crash halts message delivery for every dependent application until the Queue Manager restarts.

Exploitation requires valid credentials to reach the vulnerable code path over the network. There is no public proof-of-concept and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability as of October 14, 2026 is 0.79%.

Root Cause

The root cause is missing validation of a pointer value before dereference inside the Queue Manager message handling logic. The code path assumes an object or field is initialized when, under specific protocol states, it is not. CWE-476 (NULL Pointer Dereference) categorizes this defect class, in which an attacker-controllable condition reaches a dereference without the preceding nullity check.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with low-privileged credentials sends a crafted request to the MSMQ Queue Manager over its exposed network protocol. The malformed request steers execution to the vulnerable branch, triggering the dereference and terminating the service. No user interaction is required, and the scope remains unchanged. The impact is limited to availability of the MSMQ service and any workloads that depend on it.

No verified exploit code is available. See the Microsoft Security Update CVE-2026-85859 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-85859

Indicators of Compromise

Unexpected termination of the MSMQ service (mqsvc.exe) with Service Control Manager event entries
Windows Error Reporting or crash dump records referencing mqqm.dll or related Queue Manager modules
Application failures reporting MSMQ connectivity loss shortly after inbound network sessions on TCP 1801, UDP 3527, or RPC endpoints 2101/2103/2105

Detection Strategies

Monitor for repeated crashes of mqsvc.exe correlated with inbound MSMQ traffic from a single authenticated source
Alert on Windows Event Log entries from source MSMQ indicating abnormal shutdown or protocol errors
Baseline MSMQ connection patterns and flag authenticated clients that generate malformed or anomalous Queue Manager requests

Monitoring Recommendations

Forward Windows Service Control Manager and Application event logs to a centralized log platform for correlation
Capture NetFlow or packet metadata for MSMQ ports to identify sources of malformed sessions
Track service restart counts for MSMQ as a reliability signal and tune alert thresholds for burst crashes

How to Mitigate CVE-2026-85859

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-85859 advisory to all systems running the MSMQ role
Inventory hosts with the Message Queuing feature enabled and prioritize patching those exposed to untrusted networks
Restrict inbound access to MSMQ ports to known application tiers using host and network firewalls

Patch Information

Microsoft released a patch concurrent with the October 13, 2026 advisory. Administrators should install the cumulative update that corresponds to each affected Windows build as listed in the Microsoft Security Response Center guidance.

Workarounds

Disable the Message Queuing Windows feature on servers that do not require it using Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
Block MSMQ ports (TCP 1801, UDP 3527, TCP 2101/2103/2105) at the perimeter and segment MSMQ traffic to trusted application subnets
Require authenticated, mutually trusted connections for MSMQ and limit which service accounts can submit messages to the Queue Manager

bash

# Configuration example: disable MSMQ where it is not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart

# Restrict inbound MSMQ traffic to a trusted application subnet
New-NetFirewallRule -DisplayName "Block MSMQ TCP 1801 (untrusted)" \
  -Direction Inbound -Protocol TCP -LocalPort 1801 \
  -RemoteAddress Any -Action Block