External risk intelligence

Microsoft Message Queuing Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-36911

Microsoft Message Queuing (MSMQ) is a Windows service used for asynchronous messaging within internal environments or between specific servers. While network-reachable, it is designed for inter-service communication rather than public internet exposure, and common deployment patterns place this service behind firewalls or within internal network segments.

Integer Overflow

Microsoft Windows 10

before 10.0.10240.20107before 10.0.14393.6167before 10.0.17763.4737before 10.0.19044.3324before 10.0.19045.3324before 10.0.22000.2295before 10.0.22621.2134r2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution, meaning an attacker could potentially run malicious software on affected systems without any user interaction. This technology is primarily used for internal server communication. The main concern is confirming if this service is exposed externally and actively used.

Attackers can run code remotely on vulnerable systems.
It impacts a core messaging service for Windows.
Confirm relevance and exposure of MSMQ services.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach the vulnerable component through the network without requiring any special access. Exploiting this vulnerability in Microsoft Message Queuing could allow an attacker to execute arbitrary code on the affected system.

Network access is sufficient.
Triggered by sending a message to MSMQ.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When Microsoft Message Queuing (MSMQ) is accessible over a network, an unauthenticated attacker could exploit this vulnerability to gain full control of affected systems. This could allow for the compromise of sensitive information, disruption of services, or the execution of arbitrary code.

System data and services could be compromised.
Remote code execution could occur.
Unauthorized system access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Microsoft Message Queuing (MSMQ) is primarily an internal service, infrastructure or platform teams managing Windows servers are likely responsible for this vulnerability. The first practical step involves identifying all MSMQ installations across the environment, confirming their network reachability and business criticality, and then coordinating with the relevant system owners for remediation planning.

Infrastructure/Platform teams own the issue.
Verify MSMQ exposure and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Message Queuing (MSMQ) used for?

Microsoft Message Queuing is a Windows service that facilitates communication between different applications and servers. It allows software systems to exchange data asynchronously, ensuring that messages are reliably delivered even if the sender and receiver are not active at the exact same time. It is a fundamental component for internal distributed systems on Windows 10, Windows 11, and various Windows Server versions.

What is the vulnerability behind CVE-2023-36911?

This vulnerability is classified as an integer overflow (CWE-190). In plain terms, the service makes a calculation error when processing incoming messages. Because of this flaw, the system can be tricked into mismanaging memory, which may allow an unauthorized person to run their own code on the machine without needing any permission or user interaction.

How does an attacker trigger this vulnerability?

The vulnerability is triggered when a specially crafted message is sent to the MSMQ service over the network. If the service is running and configured to accept messages, it can be manipulated by this input. Simply having the service installed is not enough for an attack to succeed; the system must be reachable and capable of processing the malicious message packets sent by an external party.

Is my system at risk if it is not on the public internet?

Halo Surface Signal notes that while MSMQ is network-reachable, it is typically intended for internal communication and often sits behind firewalls. Systems that are not exposed to the public internet face a lower risk, but those reachable within your internal network could still be targeted if an attacker gains entry to your environment. Understanding your specific network topology is essential for assessing true relevance.

What should I do if I am running MSMQ?

Start by identifying which servers in your environment have the MSMQ service enabled. Once you have a list, verify whether these services truly need to be reachable over your network or if they can be restricted. Coordinate with your infrastructure teams to confirm the business importance of these installations and prepare to apply the necessary security updates provided by Microsoft to address the flaw.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36911

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.