CVE-2023-21554

What it actually does

CVE-2023-21554 is a network-based remote code execution vulnerability in Microsoft Message Queuing (MSMQ). When the MSMQ service is enabled, it listens for queue traffic, commonly on TCP port 1801. A remote, unauthenticated attacker can send specially crafted MSMQ packets to a vulnerable Windows host and trigger memory corruption that can result in arbitrary code execution in the context of the MSMQ service. The CVSS vector indicates exploitation requires network access only, no credentials, no user interaction, and can fully compromise confidentiality, integrity, and availability of the affected system.

Why it matters to the business

Successful exploitation can give an attacker control of a Windows workstation or server running MSMQ, enabling malware deployment, data theft, lateral movement, service disruption, or ransomware staging. The risk is elevated because exploitation is weaponized, the EPSS score is very high, and the affected product set includes many supported and legacy Windows client and server versions. Organizations that expose MSMQ internally or externally face increased operational risk, especially where MSMQ is installed on application servers, legacy systems, or infrastructure that has broad network reach.

How an attack unfolds

An attacker first identifies Windows systems with MSMQ enabled, typically by scanning for TCP port 1801 or other MSMQ-related exposure. If the target has not received the April 2023 or later Microsoft security updates addressing this vulnerability, the attacker sends crafted MSMQ protocol traffic to the service. The malformed request triggers the vulnerable code path in the MSMQ service and can cause remote code execution without authentication or user interaction. After code execution, the attacker may launch a payload under the service context, establish persistence, disable defenses, dump credentials, pivot to other systems, or deploy disruptive malware. Because MSMQ is often used by business applications and may be present on servers that are not routinely internet-facing, attackers may also exploit it after gaining internal network access.

How to fix it

Apply the Microsoft security updates released in April 2023 or any later cumulative update for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2008, 2012, 2016, 2019, and 2022 where applicable. If MSMQ is not required, remove or disable the Microsoft Message Queuing feature. If MSMQ is required, restrict access to trusted systems only, block inbound TCP 1801 from untrusted networks, and ensure MSMQ is not exposed to the internet. Use host firewalls, network ACLs, and segmentation to limit queue access to known application peers. For legacy systems that cannot be patched immediately, prioritize compensating controls: disable MSMQ where possible, isolate the host, block MSMQ traffic at network boundaries, and closely monitor for exploitation attempts.

How to confirm the fix worked

Confirm that all affected Windows systems have installed the April 2023 or later cumulative security update applicable to the OS version. Verify whether MSMQ is installed and running by checking the Windows feature state, the Message Queuing service, and listening network ports. Confirm that TCP 1801 is not reachable from untrusted networks and is only accessible from approved application peers. Validate firewall rules from both the host and network perspective. For patch validation, compare installed Windows cumulative update levels against Microsoft’s security update guidance for April 2023 or later. For exposure validation, perform authenticated inventory for MSMQ feature presence and network scanning for TCP 1801 across server and workstation ranges.

Typical attack path

1. Scan networks for systems listening on MSMQ-related ports, especially TCP 1801.
2. Fingerprint likely Windows hosts and determine whether Microsoft Message Queuing is enabled.
3. Send a crafted MSMQ packet sequence to a vulnerable, unpatched target.
4. Achieve code execution through the MSMQ service process.
5. Run a payload, command shell, loader, or post-exploitation framework on the compromised system.
6. Perform privilege escalation, credential theft, discovery, and lateral movement as needed.
7. Use the compromised host to access business applications, exfiltrate data, disrupt services, or stage ransomware.

How to detect it

To determine whether exploitation may have already occurred, review network telemetry for unexpected inbound connections to TCP 1801, especially from internet sources, user workstations, VPN pools, or systems that are not approved MSMQ peers. Correlate those connections with endpoint activity on the target around the same timestamps. Focus on suspicious child processes or process chains involving the MSMQ service process, unexpected service creation, scheduled tasks, new local users, credential dumping tools, PowerShell or command-shell execution, and outbound connections shortly after MSMQ traffic. Review Windows Security logs for process creation if enabled, Service Control Manager events for new or modified services, PowerShell operational logs, Defender/EDR alerts, firewall logs, and MSMQ operational logs. Because exploitation traffic and payloads can vary, absence of a single signature does not rule out compromise; prioritize behavioral evidence showing MSMQ network activity followed by code execution, persistence, discovery, or lateral movement.

• TCP/1801
• mqsvc.exe
• Message Queuing
• MSMQ
• Microsoft-Windows-MSMQ
• Microsoft-Windows-MSMQ/Operational
• %windir%\System32\msmq
• %windir%\System32\msmq\storage
• HKLM\SOFTWARE\Microsoft\MSMQ
• sc.exe create
• schtasks.exe /create
• powershell.exe -enc
• cmd.exe /c
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin.exe /transfer

What your security team should do

• Immediately inventory systems with Microsoft Message Queuing installed or listening on TCP 1801.
• Prioritize patching internet-facing, DMZ, application server, and high-value internal Windows systems that run MSMQ.
• Disable MSMQ on systems that do not explicitly require it.
• Block inbound TCP 1801 from the internet and restrict internal MSMQ access to approved source-destination pairs.
• Hunt for unexpected MSMQ exposure, especially on workstations and servers where the feature is not part of an approved application design.
• Review endpoint and network telemetry for suspicious connections to TCP 1801 followed by process creation, service creation, credential access, or lateral movement.
• Increase monitoring on vulnerable or recently patched MSMQ servers for signs of web shells, loaders, remote access tools, ransomware precursors, and abnormal child processes from service contexts.
• For legacy Windows systems that cannot be patched, isolate them and document explicit risk acceptance with compensating network controls.