CVE-2026-69579

CVE-2026-69579 is a use-after-free memory corruption flaw (CWE-416) in Microsoft's Windows Message Queuing (MSMQ) component, patched as part of Microsoft's September 2026 Patch Tuesday. A remote, unauthenticated attacker can trigger the flaw over the network by sending crafted traffic to the MSMQ service, with no user interaction or privileges required (CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution in the context of the Message Queuing service, with high impact on confidentiality, integrity, and availability. Only Windows systems where the optional MSM feature/role is installed and enabled are exposed; systems without MSMQ are not affected. As of the advisory data, there is no known public proof-of-concept, it is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported (EPSS 1.0%, 60th percentile).

What to do: Apply the September 2026 Patch Tuesday security updates from Microsoft to all Windows hosts running Message Queuing, prioritizing any MSMQ servers exposed to untrusted networks or the internet. As an interim mitigation, consider disabling the MSMQ service/feature if it is not required by legacy line-of-business applications, or restrict inbound access to MSMQ ports (e.g., TCP/UDP 1801 and related) at the firewall. Audit your estate to confirm whether MSMQ is installed/enabled (e.g., via Server Manager or Get-WindowsFeature on Windows Server) before patching.