Organisations at Risk: Critical Unauthenticated RCE in Windows MQ Affects Win 10/11 Builds

Microsoft has released security updates to address a critical remote code execution vulnerability in the Windows Message Queuing component. The flaw, tracked as CVE-2026-100202, exists in the Queue Manager and allows unauthorized attackers to execute code over a network without any form of authentication. According to the National Vulnerability Database, the issue stems from a use-after-free error, classified under CWE-416, which can lead to full system compromise if exploited successfully.

How it unfolded

• Microsoft published an advisory identifying the use-after-free vulnerability in the Windows Message Queuing Queue Manager.
• The National Vulnerability Database assigned a CVSS score of 9.8, rating the severity as critical.
• Specific build numbers were released for affected Windows 10 and Windows 11 versions to patch the flaw.

Who is affected

The vulnerability impacts several versions of Microsoft Windows, including Windows 10 Version 1607 before build 10.0.14393.9612 and Windows 10 Version 1809 before build 10.0.17763.9376. Windows 10 Version 21H2 and Version 22H2 are also affected if they remain below build 10.0.19044.7807. Microsoft Windows 11 version 23H2 is vulnerable if it is running a build prior to 10.0.22631.7652. Organizations running these specific builds on systems with Message Queuing enabled are at risk.

Our take on the response

Microsoft’s release of specific build updates indicates a rapid response to the critical nature of the unauthenticated remote code execution flaw. The high severity score reflects the ease with which an attacker could exploit this vulnerability without needing credentials. That suggests organizations must prioritize patching these specific builds immediately to prevent potential network-wide compromise. The availability of patches reduces the window of exposure significantly.

Who needs to act first

Teams should prioritize updating systems that are directly exposed to untrusted networks or the internet, as these face the highest risk of exploitation. Verify which servers and workstations have the Message Queuing feature installed before deploying updates, as this component is not enabled by default on all systems. Test the patches in a controlled environment to ensure compatibility with existing applications that rely on message queuing services. Back up critical system states before applying updates to allow for quick recovery if issues arise during the patching process.

What to do and how to stay safe: Microsoft

• Identify all systems running affected Windows 10 and 11 builds that have the Message Queuing feature enabled.
• Apply the latest security updates provided by Microsoft to reach the specified safe build numbers.
• Monitor network traffic for unusual connections or attempts to interact with the Message Queuing service ports.
• Review access controls to ensure that only authorized users and systems can initiate message queue operations.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-100202?

The National Vulnerability Database assigns a CVSS score of 9.8, rating the vulnerability as critical.

Which Windows 11 version is affected by this flaw?

Windows 11 version 23H2 is affected if it is running a build prior to 10.0.22631.7652.

Does this vulnerability require user authentication to exploit?

No, the flaw allows an unauthorized attacker to execute code over a network without authentication.