Microsoft has disclosed a use-after-free vulnerability in Windows Message Queuing (MSMQ) that lets an unauthorized attacker execute code over a network, rated CVSS 9.8 Critical.
What Is It
CVE-2026-69579 is a use-after-free flaw in Windows Message Queuing. Per Microsoft's description, the issue "allows an unauthorized attacker to execute code over a network." The CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scores it 9.8 (Critical): network-reachable, low attack complexity, no privileges, and no user interaction required, with high impact to confidentiality, integrity, and availability.
The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently carries an NVD status of "Undergoing Analysis."
Why It Matters
The combination of no authentication, no user interaction, low complexity, and remote code execution puts this at the top of the triage list. MSMQ is an optional Windows component, but where it is enabled it typically listens on the network, and the affected list spans nearly the entire supported Windows client and server fleet; including Server Core installations, which are often assumed to have a reduced attack surface.
CVE-2026-69579 does not appear in CISA's Known Exploited Vulnerabilities catalog, so there is no public confirmation of active exploitation and no KEV-mandated remediation deadline for federal agencies.
What's Vulnerable
Microsoft lists the following as affected below the fixed builds:
- Windows 10: 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 and 22H2 (< 10.0.19044.7725 / 10.0.19045.7725)
- Windows 11: 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server: 2012 and 2012 R2 (< 6.2.9200.26349 / 6.3.9600.23397), 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025 (< 10.0.26100.9445), including Server Core installations
Note that Windows Server 2025 and Windows 11 24H2 ship from the same 10.0.26100 branch and share servicing revisions, so both reach a fixed state at the same build number.
Affected platforms cover 32-bit, x64-based, and ARM64-based systems depending on the product.
Patch Status
Fixed builds are identified for every affected product listed above; updating to at or above the stated build remediates the issue. Consult Microsoft's Security Update Guide entry for the specific update packages. Microsoft's advisory lists no workarounds and no mitigations for this vulnerability, so installing the update is the only remediation. Where patching must be deferred, disabling the MSMQ component or blocking its network ports at the host and perimeter removes the exposed listener.
Sources
- Microsoft Security Response Center; CVE-2026-69579: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69579
- NVD, CVE-2026-69579: https://nvd.nist.gov/vuln/detail/CVE-2026-69579
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog