CVE-2023-36606

What it actually does

CVE-2023-36606 is a remotely reachable denial-of-service vulnerability in Microsoft Message Queuing (MSMQ). An unauthenticated attacker can send specially crafted network traffic to a Windows system with MSMQ enabled and cause the Message Queuing service, and potentially dependent applications, to become unavailable. The vulnerability affects availability only; it does not provide code execution, privilege escalation, or data disclosure by itself. Exposure is most relevant where MSMQ is installed and reachable over the network, particularly on systems listening for Message Queuing traffic such as TCP port 1801.

Why it matters to the business

Successful exploitation can interrupt applications or business workflows that rely on Microsoft Message Queuing, including asynchronous transaction processing, integration workloads, and legacy Windows-based messaging services. Because exploitation requires no authentication and can be performed over the network, externally or broadly reachable MSMQ services create an avoidable outage risk. The EPSS score is relatively high, indicating meaningful likelihood of exploitation attempts, although the vulnerability is not currently listed in CISA KEV and is not known to be used in ransomware campaigns based on the provided data.

How an attack unfolds

An attacker first identifies Windows systems with Microsoft Message Queuing enabled, typically by scanning for hosts exposing MSMQ-related services such as TCP port 1801. If the service is reachable, the attacker sends crafted MSMQ traffic designed to trigger the denial-of-service condition. Because the flaw is unauthenticated and requires no user interaction, the attacker does not need valid credentials or prior access. A successful attempt can crash, hang, or destabilize the Message Queuing service, disrupting applications that depend on it until the service recovers, is restarted, or the host is remediated. Repeated exploitation can be used to sustain an outage.

How to fix it

Apply the applicable Microsoft security updates for October 2023 or any later cumulative update for the affected Windows version. Where MSMQ is not required, remove or disable the Microsoft Message Queuing feature. Restrict network access to MSMQ services to only trusted application peers; block inbound MSMQ traffic, especially TCP port 1801, from untrusted networks and the internet. Use host firewalls, network ACLs, and segmentation to limit exposure. For legacy Windows versions, verify extended support eligibility and apply the corresponding security-only or cumulative updates where available. Systems that cannot be patched immediately should have MSMQ disabled if possible or isolated behind strict allowlists until patched.

How to confirm the fix worked

Confirm whether MSMQ is installed and running using Windows feature and service checks such as querying the MSMQ feature state and the Message Queuing service status. Verify the host has received the October 2023 Microsoft security update or a later cumulative update applicable to its Windows release. Confirm TCP port 1801 and other MSMQ-related endpoints are not reachable from untrusted networks. Validate firewall policy from an external vantage point, not only from the host itself. After patching or disabling MSMQ, monitor for continued service crashes or unexpected inbound MSMQ traffic to confirm the exposure has been reduced.

Typical attack path

1. Scan network ranges for Windows hosts exposing Microsoft Message Queuing, commonly TCP port 1801.
2. Confirm MSMQ is reachable from the attacker-controlled network location.
3. Send specially crafted MSMQ traffic to the vulnerable service.
4. Trigger a crash, hang, or resource exhaustion condition in the Message Queuing service.
5. Repeat requests to prolong service disruption or target additional MSMQ-enabled systems.

How to detect it

Because this is a denial-of-service vulnerability, exploitation may leave limited forensic evidence beyond network activity and service failure artifacts. Review firewall, IDS/IPS, NetFlow, and packet capture data for unexpected or repeated connections to MSMQ services, especially TCP port 1801, from untrusted or unusual sources. On Windows hosts, review System event logs for Service Control Manager events indicating the Message Queuing service terminated unexpectedly or restarted. Review Windows Error Reporting and Application logs for crashes involving mqsvc.exe. Investigate correlated spikes in inbound MSMQ traffic followed by application errors, queue processing failures, service restarts, or host instability. If available, inspect EDR telemetry for abnormal network-triggered failures of the MSMQ service process without corresponding administrative activity.

• mqsvc.exe
• Message Queuing
• MSMQ
• TCP/1801
• port 1801
• Service Control Manager
• Event ID 7031
• Event ID 7036
• The Message Queuing service terminated unexpectedly
• Microsoft-Windows-MSMQ
• Windows Error Reporting
• Application Error
• Faulting application name: mqsvc.exe

What your security team should do

• Identify all Windows systems with Microsoft Message Queuing installed, enabled, or listening on TCP port 1801.
• Prioritize patching internet-facing, DMZ, partner-accessible, and broadly reachable internal MSMQ systems.
• Apply the October 2023 Microsoft security updates or later cumulative updates for all affected Windows versions.
• Disable or uninstall MSMQ wherever it is not explicitly required by an application.
• Restrict MSMQ access to known application peers using host firewalls and network segmentation.
• Create monitoring for inbound MSMQ traffic from untrusted sources and for repeated Message Queuing service crashes or restarts.
• Review application dependencies before disabling MSMQ to avoid unintended business disruption.
• For systems that cannot be patched, document compensating controls and isolate them until remediation is complete.