Key points
- CVE-2026-100202 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw exists in the Windows Message Queuing Queue Manager component.
- Affected systems include Windows 10 versions 1607 through 22H2 and Windows 11 version 23H2.
An unauthorised attacker can execute code over a network by exploiting a memory management error in Microsoft Windows. This vulnerability, identified as CVE-2026-100202, grants remote code execution without requiring any login credentials. The National Vulnerability Database assigns it a CVSS score of 9.8, classifying it as Critical. This severity indicates a high risk of widespread compromise for exposed systems.
In plain English
The issue stems from a "use-after-free" error within the Windows Message Queuing Queue Manager. In simple terms, the software attempts to use a piece of computer memory that has already been released or freed. This creates an unstable state that an attacker can manipulate to run their own instructions on the machine. Because the flaw allows remote exploitation, the attacker does not need physical access or prior authentication to the target system.
The background
Microsoft Windows 10 Version 1607 is affected if it runs build 10.0.14393.9612 or earlier. Windows 10 Version 1809 is vulnerable before build 10.0.17763.9376. Windows 10 Version 21H2 and 22H2 are at risk before build 10.0.19044.7807. Windows 11 version 23H2 is affected before build 10.0.22631.7652. The Common Weakness Enumeration categorises this as CWE-416, which specifically covers use-after-free errors in software development.
What changes now
Organisations must verify which Windows builds are currently deployed across their infrastructure. Systems running the vulnerable builds listed above are exposed to remote attacks. As RedTeam Log reported on 2026-10-11, similar unauthenticated flaws in other enterprise software, such as PaperCut MF, have complicated patching efforts significantly. This history suggests that rapid identification and remediation are essential to prevent exploitation of this Windows component.
The attacker's path
Attackers typically scan for services exposed to the network that lack authentication requirements. When they identify a vulnerable message queuing service, they send crafted requests to trigger the memory error. This technique serves as an initial access vector, allowing them to bypass perimeter defences. Teams usually monitor for unusual outbound traffic from servers that should only handle internal messaging. Check whether message queuing services are accessible from untrusted networks to reduce exposure.
What to do and how to stay safe: Microsoft Windows
- Identify all systems running the affected Windows builds listed in the NVD record.
- Ensure that Windows Message Queuing services are not accessible from external or untrusted networks.
- Monitor server logs for unusual activity or unexpected connections to the Queue Manager.
- Prepare to apply updates once Microsoft releases patches for the affected versions.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-100202?
The National Vulnerability Database rates the vulnerability as 9.8, which is classified as Critical.
Which Windows versions are affected by this flaw?
Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 version 23H2, are affected before specific builds.
Does an attacker need credentials to exploit this?
No, the description states that an unauthorised attacker can execute code over a network without requiring login credentials.
