Windows Message Queuing: Denial-of-Service vulnerability

Summary

Windows Message Queuing (MSMQ) on supported Windows 10, Windows 11 and Windows Server versions contains a flaw. Microsoft describes it as improper input validation, while the listed weakness is CWE-476 (NULL pointer dereference), so the root cause is not clear from public data. An authorized attacker with network access and a valid account can cause a denial of service that affects only availability. Exploitation is rated as complex, and MSMQ is an optional feature, so exposure is limited to hosts where it is installed.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2 and 26H1 (26H2 listed in the CVE record)
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Exact affected ranges per product: see the CVE record (for example, Windows 11 23H2 before 10.0.22631.7711).

Fixed in

• Fix shipped in the November 2026 cumulative updates (Patch Tuesday, 10 November 2026).
• Per the CVE record, fixed builds start at 10.0.22631.7711 (Windows 11 23H2), 10.0.26100.9974 (24H2) and 10.0.20348.5870 (Server 2022).
• Third-party trackers list KB5131087 (Windows 11 23H2), KB5132061 (24H2), KB5132059 (26H1), KB5131085 (Server 2019 and 10 1809) and KB5131090 (Server 2022). Verify these against the Microsoft Update Catalog and the MSRC advisory.
• Exact fixed build for each product: unknown until verified on the MSRC advisory.

Workaround

• No CVE-specific workaround is published.
• If MSMQ is not needed, disable the Message Queuing service or remove the optional feature.
• Block inbound TCP 1801 from untrusted networks (general MSMQ guidance from earlier advisories, not from this CVE).

Exploitation

• CISA SSVC: exploitation none, not automatable, partial technical impact.
• Rapid7: 'Exploitation Less Likely', not exploited.
• No public proof of concept found.
• No confirmed in-the-wild exploitation found.

Our recommendation

• Check whether MSMQ or the Message Queuing service is installed on any Windows host, including Server 2016, 2019 and 2022.
• If MSMQ is not needed, disable it or remove the feature.
• If MSMQ is needed, install the November 2026 cumulative update.
• Block inbound TCP 1801 from untrusted networks and check internet exposure of this port.
• Confirm the exact fixed build for each product on the MSRC advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-119848 (CVE.org) www.cve.org
• Microsoft Security Update Guide CVE-2026-119848 msrc.microsoft.com
• Strix AI CVE-2026-119848 www.strix.ai
• Senserva KB5131087 (Windows 11 23H2) senserva.com
• Senserva KB5132061 (Windows 11 24H2) senserva.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Automox MSMQ mitigation guidance www.automox.com
• PentestPad port 1801 (MSMQ) www.pentestpad.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:32.