Loading story…
Microsoft patched CVE-2023-21554, dubbed QueueJumper, a critical unauthenticated remote-code-execution vulnerability in Microsoft Message Queuing (MSMQ). An attacker can exploit the flaw through TCP port 1801 to execute code in the mqsvc.exe service context, potentially enabling remote compromise of affected Windows systems where MSMQ is enabled.
Organizations should apply Microsoft’s April 2023 security updates. Where patching cannot occur immediately, defenders should disable MSMQ when it is not required or block untrusted inbound traffic to TCP port 1801; the same update release also remediated the actively exploited CLFS elevation-of-privilege flaw CVE-2023-28252, which had been used to obtain SYSTEM privileges in Nokoyawa ransomware attacks.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Two days after the April Patch Tuesday release, Wiz Research reported that 84% of surveyed cloud environments had not installed the latest KB updates, leaving 16% protected against both CVE-2023-21554 and CVE-2023-28252.
Microsoft's April 2023 Patch Tuesday fixed 97 vulnerabilities, including the critical MSMQ remote-code-execution flaw CVE-2023-21554 (QueueJumper) and CVE-2023-28252, a CLFS privilege-escalation zero-day actively used to deploy Nokoyawa ransomware.
The Nokoyawa ransomware group began using other exploits targeting the Windows Common Log File System (CLFS), which were attributed to a single exploit developer.
Nokoyawa ransomware first emerged, targeting 64-bit Windows systems and using double extortion against victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for **Microsoft Message Queuing (MSMQ)** to address three disclosed vulnerabilities affecting the Windows messaging component. The issues include **`CVE-2024-49122`**, a **remote code execution** flaw, alongside **`CVE-2025-21181`** and **`CVE-2025-21289`**, both classified as **denial-of-service** vulnerabilities in MSMQ. The advisories indicate that organizations running systems with MSMQ enabled should review Microsoft's Security Update Guide entries and apply the relevant patches to reduce the risk of service disruption or potential code execution. The combination of one RCE bug and two DoS flaws highlights continued security exposure in MSMQ, a legacy Windows feature that may remain active in enterprise environments even when it is not widely used.
Jul 12, 2026
Microsoft disclosed two new vulnerabilities in **Windows Message Queuing (MSMQ)**: `CVE-2026-34329`, a heap-based buffer overflow that can let an unauthorized attacker on an adjacent network send a specially crafted MSMQ message and achieve remote code execution, and `CVE-2026-33838`, a double-free flaw that can allow a local low-privileged attacker to gain **SYSTEM** privileges. Microsoft rated both issues **Important**, assigned CVSS scores of **8.8** and **7.8** respectively, said neither was publicly disclosed or exploited in the wild at publication, and released fixes for both vulnerabilities. Microsoft credited Azure Yang (`@4zure9`) of Kunlun Lab with reporting `CVE-2026-34329`. The disclosures add to a longer pattern of serious MSMQ security issues previously tracked by Microsoft, including `CVE-2023-21554` and multiple 2023 MSMQ remote code execution bugs such as `CVE-2023-36572`, `CVE-2023-36575`, `CVE-2023-36578`, `CVE-2023-36583`, `CVE-2023-36589`, and `CVE-2023-36590`. The repeated appearance of MSMQ flaws across releases underscores the continued risk posed by the legacy Windows messaging component, particularly where the service is enabled and reachable from adjacent networks or accessible to local users.
Jun 29, 2026
Microsoft disclosed and patched two denial-of-service flaws in **Microsoft Message Queuing (MSMQ)**, tracked as **`CVE-2023-28302`** and **`CVE-2023-36606`**, through its Security Update Guide. Both issues affect the Windows messaging component and could allow an attacker to disrupt service availability on systems where MSMQ is enabled. The vulnerabilities were published in separate Microsoft advisories and add to the security risk surrounding exposed or unnecessary MSMQ deployments. Organizations using MSMQ should review Microsoft’s guidance, apply the relevant security updates, and verify whether the service is required on internet-facing or internal systems to reduce the likelihood of service disruption.
Jul 12, 2026