Loading story…
Microsoft published security advisories for two information disclosure vulnerabilities affecting Microsoft Exchange Server and Microsoft Message Queuing (MSMQ), tracked as CVE-2021-33766 and CVE-2021-43236. The flaws were documented through the Microsoft Security Response Center as part of the company’s Security Update Guide, indicating that supported deployments of both enterprise messaging technologies required vendor-issued updates.
The disclosures highlight continued security risk in core Microsoft communication services used widely in corporate environments. Organizations running Exchange Server or MSMQ were advised to review the relevant advisories, determine exposure to the affected components, and apply Microsoft’s security updates to reduce the risk of unauthorized access to sensitive information.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published Security Update Guide information for CVE-2021-43236, an information disclosure vulnerability affecting Microsoft Message Queuing.
Microsoft added CVE-2021-33766, an information disclosure vulnerability affecting Microsoft Exchange Server, to its Security Update Guide.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
portal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched two denial-of-service flaws in **Microsoft Message Queuing (MSMQ)**, tracked as **`CVE-2023-28302`** and **`CVE-2023-36606`**, through its Security Update Guide. Both issues affect the Windows messaging component and could allow an attacker to disrupt service availability on systems where MSMQ is enabled. The vulnerabilities were published in separate Microsoft advisories and add to the security risk surrounding exposed or unnecessary MSMQ deployments. Organizations using MSMQ should review Microsoft’s guidance, apply the relevant security updates, and verify whether the service is required on internet-facing or internal systems to reduce the likelihood of service disruption.
Jul 12, 2026
Microsoft released security updates for **Microsoft Message Queuing (MSMQ)** to address three disclosed vulnerabilities affecting the Windows messaging component. The issues include **`CVE-2024-49122`**, a **remote code execution** flaw, alongside **`CVE-2025-21181`** and **`CVE-2025-21289`**, both classified as **denial-of-service** vulnerabilities in MSMQ. The advisories indicate that organizations running systems with MSMQ enabled should review Microsoft's Security Update Guide entries and apply the relevant patches to reduce the risk of service disruption or potential code execution. The combination of one RCE bug and two DoS flaws highlights continued security exposure in MSMQ, a legacy Windows feature that may remain active in enterprise environments even when it is not widely used.
Jul 12, 2026
Microsoft disclosed two new vulnerabilities in **Windows Message Queuing (MSMQ)**: `CVE-2026-34329`, a heap-based buffer overflow that can let an unauthorized attacker on an adjacent network send a specially crafted MSMQ message and achieve remote code execution, and `CVE-2026-33838`, a double-free flaw that can allow a local low-privileged attacker to gain **SYSTEM** privileges. Microsoft rated both issues **Important**, assigned CVSS scores of **8.8** and **7.8** respectively, said neither was publicly disclosed or exploited in the wild at publication, and released fixes for both vulnerabilities. Microsoft credited Azure Yang (`@4zure9`) of Kunlun Lab with reporting `CVE-2026-34329`. The disclosures add to a longer pattern of serious MSMQ security issues previously tracked by Microsoft, including `CVE-2023-21554` and multiple 2023 MSMQ remote code execution bugs such as `CVE-2023-36572`, `CVE-2023-36575`, `CVE-2023-36578`, `CVE-2023-36583`, `CVE-2023-36589`, and `CVE-2023-36590`. The repeated appearance of MSMQ flaws across releases underscores the continued risk posed by the legacy Windows messaging component, particularly where the service is enabled and reachable from adjacent networks or accessible to local users.
Jun 29, 2026