# Microsoft CVE-2023-36910: Microsoft Message Queuing Remote Code Execution Vulnerability

**URL:** <https://discuss.rapid7.com/t/microsoft-cve-2023-36910-microsoft-message-queuing-remote-code-execution-vulnerability/26570>\
**Category:** InsightVM\
**Tags:** InsightVM\
**Created:** [August 22, 2023, 5:44am UTC](https://discuss.rapid7.com/t/microsoft-cve-2023-36910-microsoft-message-queuing-remote-code-execution-vulnerability/26570 "2023-08-22T05:44:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![beng](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/b3f665/32.png) [@beng](https://discuss.rapid7.com/u/beng)\
**Post date:** [August 22, 2023, 5:44am UTC](https://discuss.rapid7.com/t/microsoft-cve-2023-36910-microsoft-message-queuing-remote-code-execution-vulnerability/26570/1 "2023-08-22T05:44:37Z")

</div>

According to MS Documentation here:  
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36910](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36910)

The system is only vulnerable if the service **Message Queuing** is running and TCP port 1801 is listening on the machine.

Can you please adjust the Vuln Check in InsightVM to check this as well?  
msft-cve-2023-36910

Thanks

---

<div class="post-metadata">

**Author:** ![kevin\_mccabe](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/k/9e8a1a/32.png) [@kevin\_mccabe](https://discuss.rapid7.com/u/kevin_mccabe)\
**Post date:** [August 22, 2023, 9:04am UTC](https://discuss.rapid7.com/t/microsoft-cve-2023-36910-microsoft-message-queuing-remote-code-execution-vulnerability/26570/2 "2023-08-22T09:04:33Z")

</div>

Our general approach is that we will flag up the existence of a vulnerability that needs to be patched or removed.

Microsofts own description of a mitigation visible in that link is “could reduce the severity of exploitation of a vulnerability”. This alligns with our view that a mitigation does not remove the vulnerability or the risk, but rather is a method of reducing your risk. Full remediation is always recommended by the vendor, and by Rapid7. Mitigations can be easily undone, leaving the system vulnerable again.

If you do not want to patch, and you are happy to accept the risk remaining, then I would recommend using an exception.