Microsoft says this month’s Patch Tuesday updates can break Message Queuing (MSMQ) on some Windows systems, triggering failures that ripple into enterprise apps — and, in some cases, IIS-hosted websites.
The issue is confirmed to affect Windows 10 22H2, Windows Server 2019, and Windows Server 2016 after installing the December 2025 security updates KB5071546, KB5071544, and KB5071543.
Which updates are involved
Microsoft ties the known issue to these December releases:
- Windows 10 22H2: KB5071546 (build 19045.6691 / 19044.6691)
- Windows Server 2019: KB5071544 (build 17763.8146)
- Windows Server 2016: KB5071543 (build 14393.8688)
What admins are seeing
Reports from affected environments describe a messy range of symptoms:
- MSMQ queues appearing inactive or stuck
- Applications failing to write messages to queues
- IIS sites failing with “insufficient resources” style errors
- Misleading messages like “There is insufficient disk space or memory,” even when systems have plenty of both
Microsoft also notes the problem can hit clustered MSMQ deployments, especially when the cluster is under load.
Why it’s happening
Microsoft attributes the failures to recent MSMQ security model and NTFS permission changes. In short: permissions on a key MSMQ folder have shifted, and the identity that sends messages via MSMQ (often a service account or an IIS app pool identity) may no longer be able to write where it needs to.
The folder in question is:
C:\Windows\System32\MSMQ\storage
With the December changes, MSMQ “users” now require write access to that directory — which is typically locked down to administrators. That’s why the issue may not show up in scenarios where the MSMQ caller is running with admin-level rights, but it can surface quickly when MSMQ is used by least-privilege services (as it usually is in production).
What to do right now
Microsoft says it’s investigating, but hasn’t shared a fix timeline or confirmed whether a resolution will arrive via the next scheduled updates or an out-of-band patch.
In the meantime, organizations caught by this may face a tough choice:
- Roll back the December updates to restore functionality (but accept the security tradeoff), or
- Adjust operational configuration to keep MSMQ working while maintaining an acceptable security posture — which may involve reviewing which service identities need MSMQ access and carefully validating any permission changes.
MSMQ’s security history isn’t trivial
This isn’t a small corner-case feature for a lot of enterprises: MSMQ is an optional Windows component that’s still used for reliable messaging in line-of-business systems.
And it’s had serious security attention before. In April 2023, Microsoft urged admins to patch CVE-2023-21554, a critical MSMQ remote code execution flaw. At the time, researchers warned that hundreds of thousands of MSMQ endpoints appeared internet-exposed — a reminder that MSMQ hardening (and patching) matters, even when it’s “just” plumbing in the background.