CVE-2023-28302

What it actually does

CVE-2023-28302 is a network-reachable denial-of-service vulnerability in Microsoft Message Queuing (MSMQ). An unauthenticated attacker can send crafted traffic to a Windows host with MSMQ enabled and cause the Message Queuing service to crash, hang, or otherwise become unavailable. The flaw does not provide confidentiality or integrity impact by itself, but it can create high availability impact for applications that rely on MSMQ for asynchronous message delivery, workflow processing, or inter-service communication.

Why it matters to the business

Successful exploitation can interrupt applications and business processes that depend on MSMQ, causing message processing delays, failed transactions, service degradation, or outages. Because exploitation is unauthenticated, network-based, and has a very high EPSS score, exposed MSMQ services should be treated as high-priority even though the issue is not currently listed in CISA KEV and has no confirmed ransomware association in the provided data. Internet exposure or broad internal network exposure materially increases operational risk.

How an attack unfolds

An attacker first identifies a Windows system with Microsoft Message Queuing enabled and reachable over the network, commonly by finding hosts listening on MSMQ-related ports such as TCP 1801. The attacker then sends malformed or specially crafted MSMQ traffic to the service. The vulnerable MSMQ component mishandles the input, resulting in service instability, crash, or loss of availability. The attacker can repeat the request pattern to keep MSMQ unavailable, disrupt dependent applications, or combine the outage with other activity such as distracting defenders or degrading monitoring and business workflows.

How to fix it

Install the applicable Microsoft security update for affected Windows versions, specifically the April 2023 security update or any later cumulative update for the relevant supported Windows release. If MSMQ is not required, disable or remove the Microsoft Message Queuing feature. If MSMQ is required, restrict access to trusted application hosts only, block external access to TCP 1801 and other MSMQ/RPC exposure at firewalls, and avoid exposing MSMQ directly to the internet. Apply network segmentation so only known producers and consumers can communicate with MSMQ systems. Ensure unsupported Windows versions are upgraded or covered by appropriate extended security update arrangements where applicable.

How to confirm the fix worked

Confirm the host is running an April 2023 or later Windows cumulative/security update applicable to its operating system version. Validate whether MSMQ is enabled by checking installed Windows features and the Message Queuing service state. From an authorized network location, verify that TCP 1801 is not reachable except from approved systems. Review firewall rules and segmentation controls to ensure MSMQ is not exposed to untrusted networks. After patching or mitigation, monitor for continued mqsvc.exe crashes, Message Queuing service restarts, and dependent application queue-processing failures.

Typical attack path

1. Scan for Windows hosts exposing Microsoft Message Queuing, especially TCP port 1801.
2. Confirm that the Message Queuing service is reachable from the attacker’s network location.
3. Send crafted MSMQ network traffic that triggers the denial-of-service condition.
4. Observe service failure, restart behavior, connection resets, application errors, or dependent application outages.
5. Repeat exploitation to maintain disruption until the service is patched, isolated, or disabled.

How to detect it

Look for evidence of attempted or successful denial of service against Microsoft Message Queuing. Relevant sources include Windows System logs, Windows Application logs, Microsoft-Windows-MSMQ operational logs if enabled, Windows Error Reporting events, endpoint telemetry, host firewall logs, network firewall logs, IDS/IPS alerts, and NetFlow. Investigate repeated crashes or restarts of the Message Queuing service, especially when correlated with inbound network connections to TCP 1801. Search for Application Error events involving mqsvc.exe, Service Control Manager events showing unexpected Message Queuing termination, Windows Error Reporting records for mqsvc.exe, and bursts of failed or reset MSMQ connections. Since this vulnerability is a denial-of-service issue, durable file-based IOCs may not exist; attribution should rely on temporal correlation between service failures and network sources sending MSMQ traffic.

• TCP/1801
• mqsvc.exe
• Message Queuing service terminated unexpectedly
• The Message Queuing service terminated unexpectedly
• Faulting application name: mqsvc.exe
• Application Error
• Windows Error Reporting
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Microsoft-Windows-MSMQ
• MSMQ

What your security team should do

• Prioritize patching or mitigation for any Windows system with MSMQ enabled and reachable from untrusted networks.
• Inventory MSMQ usage across Windows servers and workstations; remove the feature where there is no business requirement.
• Block inbound access to TCP 1801 from the internet and restrict internal access to known application peers.
• Monitor for repeated Message Queuing service crashes, unexpected service restarts, or spikes in inbound MSMQ traffic.
• Correlate MSMQ service instability with firewall, IDS, NetFlow, and Windows event logs to identify possible exploitation sources.
• Add MSMQ exposure checks to vulnerability management and attack surface management workflows.
• For systems that cannot be patched promptly, apply compensating controls such as host firewall rules, network ACLs, and service isolation.