cbcvebase.
CVE-2023-21554
published 2023-04-11

CVE-2023-21554: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
95.45%
99.9th percentile
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Affected

40 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1607< 10.0.14393.585010.0.14393.5850
microsoftwindows_10_1809< 10.0.17763.425210.0.17763.4252
microsoftwindows_10_20h2< 10.0.19042.284610.0.19042.2846
microsoftwindows_10_21h2< 10.0.19044.284610.0.19044.2846
microsoftwindows_10_22h2< 10.0.19045.284610.0.19045.2846
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.1986910.0.10240.19869
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.585010.0.14393.5850
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.425210.0.17763.4252
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.425210.0.17763.4252
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.284610.0.19042.2846
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.284610.0.19044.2846
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.284610.0.19045.2846
microsoftwindows_11_21h2< 10.0.22000.181710.0.22000.1817
microsoftwindows_11_22h2< 10.0.22621.155510.0.22621.1555
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.181710.0.22000.1817
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.155510.0.22621.1555
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.264666.1.7601.26466
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.220156.0.6003.22015
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.242166.2.9200.24216
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.209196.3.9600.20919
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.585010.0.14393.5850
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.425210.0.17763.4252
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.166810.0.20348.1668

Detection & IOCsextracted from sources · hover to see the quote

port1801/tcp
processmqsvc.exe
processMQSVC.EXE
pathC:\Windows\System32\MSMQ\storage
  • Monitor for inbound connections to TCP port 1801 from untrusted/external sources; a single specially crafted packet to this port is sufficient to trigger CVE-2023-21554.
  • GreyNoise tag 'Microsoft Message Queuing (MSMQ) QueueJumper RCE Attempt' (classified malicious) can be used to identify IPs actively scanning/exploiting CVE-2023-21554.
  • The vulnerability is triggered via the message header parser routine CQmPacket::CQmPacket in MQQM.DLL; monitor for anomalous MSMQ packet structures with malformed EodHeader, StreamIdSize, or OrderQueueSize fields.
  • The attack surface is reachable via both TCP port 1801 and RPC ports exposed by MQQM.DLL; prioritize blocking/monitoring port 1801 as three RCE/DoS vulnerabilities were found reachable through it.
  • ·MSMQ is not enabled by default but is silently enabled by popular software (e.g., Microsoft Exchange Server) during installation, potentially leaving systems exposed without administrator awareness.
  • ·Internet scan data showed over ~360,000 IPs with port 1801/tcp open to the Internet; internal network exposure is expected to be significantly higher.
  • ·Within two days of Patch Tuesday, 84% of cloud environments had not yet applied the relevant KB, indicating slow patch adoption rates in practice.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.