Windows MSMQ CVE-2026-72932

Exploitation requires network-layer reachability to the target's MSMQ service on TCP port 1801 (and RPC endpoint mapper on TCP 135). The Windows Message Queuing feature must be installed and the service running-MSMQ is not enabled by default on Windows desktop SKUs and must be explicitly added as a Windows Feature; on Windows Server editions it may be present but is also not default-enabled in base installations. The CVSS vector PR:N/UI:N confirms no authentication or user interaction is required once the service is reachable. Key limiting factors: MSMQ is an optional, non-default component; most perimeter firewalls block TCP 1801 from the internet; exploitation from the LAN or post-compromise pivot position is trivially achievable with no special conditions. Attackers already inside the network perimeter face no meaningful barriers once MSMQ hosts are identified.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 and reflects a remotely exploitable, unauthenticated information disclosure with no interaction required-an accurate characterization of an over-read in a network-facing service. No EPSS score was supplied in the intelligence data, but the combination of zero authentication, low complexity, and a well-known target port (TCP 1801) makes automated mass-scanning feasible once a reliable trigger is known. The absence of a KEV listing and no reported public exploit code reduce immediate priority compared to active RCE campaigns, but the impact class of C:H is credible given that process memory reads can expose cryptographic material, session tokens, or cached credentials. Real-world risk is heavily mediated by network exposure: organizations that filter MSMQ ports at the perimeter or segregate MSMQ hosts to isolated segments face substantially lower risk, whereas any environment with internet-exposed MSMQ is at high risk. Even a mid-sized municipal IT team in inowroclaw maintaining legacy MSMQ-integrated ERP workloads on unpatched Windows Server 2019 should treat this patch as urgent, since a disclosed session credential or signing key can pivot directly to lateral movement. The wide version footprint-nineteen distinct affected version ranges-suggests this is a systemic flaw in the MSMQ parsing pipeline rather than a version-specific regression.

An unauthenticated attacker with network access to a Windows host sends a specially crafted MSMQ protocol frame to TCP port 1801. The Queue Manager processes the malformed message and reads beyond the allocated input buffer, embedding adjacent heap or stack memory bytes into the protocol response returned to the attacker. The attacker captures and parses the response, potentially extracting in-process secrets such as NTLM hashes, Kerberos tickets, or application-layer credentials that enable further lateral movement.