Windows Message Queuing use-after-free allows remote code execution (CVE-2026-69579)

What happened

Windows Message Queuing contains a use-after-free vulnerability (CWE-416). An attacker who can reach the service over the network can exploit it without credentials and without any action by a logged-in user, potentially executing code with the same privileges as the affected service. Microsoft rates it critical with a CVSS v3.1 score of 9.8.

The SSVC assessment describes the vulnerability as automatable with total technical impact. The CVE record does not list exploitation or public disclosure, and it is not present in CISA's Known Exploited Vulnerabilities catalogue. Microsoft has not published a workaround.

Who is affected

The advisory names these affected products: Windows 10 Version 1607, 1809, 21H2 and 22H2; Windows 11 version 23H2, 24H2, 25H2 and 26H1; Windows Server 2012; Windows Server 2012 (Server Core installation); and Windows Server 2012 R2. The fixed-build list also covers Windows Server 2016, 2019, 2022 and 2025, including Server Core editions where applicable.

What to do now

1. Identify Windows and Windows Server systems where the Message Queuing service is enabled.
2. Apply the Microsoft security update that fixes this CVE. Fixed builds include 10.0.14393.9512 for Windows 10 1607 and Windows Server 2016; 10.0.17763.9245 for Windows 10 1809 and Windows Server 2019; 10.0.19044.7725 and 10.0.19045.7725 for Windows 10 21H2 and 22H2; 10.0.22631.7582 for Windows 11 23H2; 10.0.26100.9445 and 10.0.26200.9445 for Windows 11 24H2 and 25H2; 10.0.28000.2954 for Windows 11 26H1; 6.2.9200.26349 for Windows Server 2012; 6.3.9600.23398 for Windows Server 2012 R2; 10.0.20348.5622 for Windows Server 2022; and 10.0.26100.33438 for Windows Server 2025.
3. If you cannot apply the update immediately, treat the Message Queuing service as exposed and restrict network access to it from untrusted segments until patching is complete.

How to detect it

Microsoft has not published indicators of compromise for this CVE. Because the vulnerability is reachable over the network without credentials, check whether the Message Queuing service is reachable from untrusted network segments.

Beyond the patch

Patch first. The exposure pattern here is a network-reachable Windows service with no authentication, which is the kind of open port that Virtual CISO Services (vCISO) exposure management catches. If code execution does happen, Managed Detection & Response (MDR) detects the post-exploitation activity. Keeping track of Microsoft's patch cycle and your Windows estate falls under Supply Chain Defense & Third-Party Risk.