CVE-2026-69579 – Windows Message Queuing Remote Code Execution Vulnerability

CVE-2026-69579 is a critical use-after-free vulnerability in Windows Message Queuing. An unauthorized, unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires low attack complexity, no privileges, and no user interaction. It is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target an affected Windows Message Queuing service remotely with a specially crafted network packet. Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability. The network-based attack path, low complexity, and lack of authentication requirements make this a significant security threat.

EXPLOITS: No exploitation is currently reported, and the vulnerability is not publicly disclosed. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-69579 is caused by a use-after-free weakness (CWE-416) in Windows Message Queuing. A use-after-free condition occurs when software continues to use memory after it has been released. For this vulnerability, an unauthenticated attacker can send a specially crafted packet over the network to an affected service and trigger the flaw. Successful exploitation can allow code execution on the target system. The CVSS metrics rate confidentiality, integrity, and availability impacts as High, with a Network attack vector, Low attack complexity, no required privileges, and no required user interaction.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. An unauthenticated attacker can exploit the vulnerability by sending a specially crafted packet to an affected service over the network.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause serious compromise of affected Windows endpoints or servers. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, enable unauthorized changes, and disrupt business services. The absence of authentication and user-interaction requirements increases the potential organizational risk.

WORKAROUND: No workaround or mitigation is identified. The official fix should be applied to affected systems.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and can be attacked remotely without authentication or user interaction. Although exploitation is currently assessed as Unlikely and no exploitation is reported, the potential for remote code execution and high impact across confidentiality, integrity, and availability makes timely deployment of the official security update important.