CVE-2026-69530

CVE-2026-69530 is a use-after-free memory-corruption flaw (CWE-416) in Microsoft's Reliable Multicast Transport Driver (RMCAST), the Windows networking component associated with the optional Message Queuing (MSMQ) feature. An unauthenticated attacker can reach the flaw over the network by sending traffic that leads the driver to use memory after it has been freed, though the High attack-complexity rating indicates exploitation depends on favorable runtime conditions rather than a simple request. A successful attack yields remote code execution on the affected host, with CVSS rating the impact high across confidentiality, integrity, and availability. Only systems where the RMCAST/MSMQ capability is installed and enabled are exposed, and the flaw was addressed in Microsoft's September 2026 Patch Tuesday release. There is currently no known exploitation, no public proof-of-concept, and no CISA KEV listing, with EPSS estimating roughly a 0.6% chance of exploitation in the next 30 days.

What to do: Apply Microsoft's September 2026 security updates as soon as practical. Inventory Windows hosts — especially servers reachable from untrusted networks — for the Message Queuing (MSMQ)/Reliable Multicast Transport feature and disable it where it is not required, since exposure requires the component to be installed and enabled. Given the High attack complexity, the absence of a public PoC, and no known exploitation, there is no indication of urgent in-the-wild risk, but patching should not be deferred.