Loading story…
A recent Microsoft security update released in December 2025 has caused significant issues with the Message Queuing (MSMQ) service on Windows 10 and older Windows Server versions. The update introduced changes to the MSMQ security model and NTFS permissions, specifically affecting the C:\Windows\System32\MSMQ\storage folder, which now requires write access for MSMQ users. As a result, MSMQ queues may become inactive, Internet Information Services (IIS) sites can fail with resource errors, and applications may be unable to write to queues, despite system resources being available. The issue primarily impacts enterprise and managed IT environments, especially those running clustered MSMQ under load, while personal devices are largely unaffected.
Administrators have reported a range of failures, including point-of-sale systems unable to issue receipts and building fire alarm systems going offline, potentially linked to the MSMQ malfunction. Microsoft has acknowledged the problem and suggested contacting their support team for a workaround, though some users have found that uninstalling the update resolves the issue. The lack of a detailed public workaround and the critical nature of affected applications have raised concerns among IT professionals about the reliability of recent security updates and the support process for urgent enterprise disruptions.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed the post-update MSMQ problem, said it was investigating, and advised affected customers to contact support for a workaround. It also noted that uninstalling the update could restore functionality, though doing so would remove the associated security fixes.
Following installation of the December 2025 update, Message Queuing queues became inactive on some systems, applications could no longer write to queues, and some IIS sites failed with resource errors. Reported impact included enterprise applications such as point-of-sale and fire alarm systems in managed IT environments.
Microsoft's December 2025 Patch Tuesday security update KB5071546 was released for certain Windows 10 and Windows Server versions. The update changed the MSMQ security model and NTFS permissions on the MSMQ storage directory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has acknowledged that recent Windows security updates have introduced significant issues affecting enterprise environments. The December 2025 Patch Tuesday updates have caused failures in the Message Queuing (MSMQ) service on Windows 10 22H2, Windows Server 2019, and Windows Server 2016, resulting in inactive queues, failed IIS sites, and applications unable to write to queues due to new security model changes that restrict necessary folder permissions. Additionally, recent updates to Windows 11 have broken VPN networking for users of the Windows Subsystem for Linux (WSL), particularly impacting enterprise VPN solutions like OpenVPN and Cisco Secure Client, with users experiencing "No route to host" errors due to virtual network interfaces not responding to ARP requests. Microsoft is actively investigating both issues but has not yet provided a timeline for fixes or workarounds. The MSMQ problem primarily affects non-administrative users and clustered environments under load, while the WSL VPN issue mainly impacts enterprise users relying on mirrored mode networking to access corporate resources. Administrators are advised to monitor for further updates from Microsoft and consider the risks of applying recent patches in critical environments until resolutions are available.
Jun 29, 2026
Microsoft released an emergency out-of-band update to address a critical issue with Message Queuing (MSMQ) on Windows 10 systems, which emerged after the December 9, 2025, security updates. The bug caused MSMQ queues to become inactive, preventing applications from writing to queues and resulting in error messages related to insufficient resources, disk space, or memory. The problem was particularly severe in enterprise and clustered MSMQ environments, especially those running Internet Information Services (IIS) sites that rely on MSMQ for asynchronous processing, leading to potential service disruptions. The out-of-band update (KB5074976) is available via the Microsoft Update Catalog and is not distributed through Windows Update or WSUS. Microsoft recommends that affected organizations, especially those with managed IT infrastructures or Azure-hosted devices, prioritize deploying the update and ensure the latest servicing stack update is installed to avoid deployment issues. Regular users with Windows Home or Pro editions are largely unaffected. Administrators are advised to test the patch in staging environments before production rollout to ensure stability and prevent further complications.
Jun 29, 2026
Microsoft disclosed and patched two denial-of-service flaws in **Microsoft Message Queuing (MSMQ)**, tracked as **`CVE-2023-28302`** and **`CVE-2023-36606`**, through its Security Update Guide. Both issues affect the Windows messaging component and could allow an attacker to disrupt service availability on systems where MSMQ is enabled. The vulnerabilities were published in separate Microsoft advisories and add to the security risk surrounding exposed or unnecessary MSMQ deployments. Organizations using MSMQ should review Microsoft’s guidance, apply the relevant security updates, and verify whether the service is required on internet-facing or internal systems to reduce the likelihood of service disruption.
Jul 12, 2026