Port 1801 – MSMQ (Microsoft Message Queuing)

Port 1801 is the default port for MSMQ (Microsoft Message Queuing), a Windows messaging service that lets applications exchange data through queues instead of talking to each other directly — so a sender and a receiver never have to be online at the same time. The queue manager service, mqsvc.exe, listens on TCP 1801 for the core MSMQ binary protocol. MSMQ also uses UDP 1801, the RPC endpoint mapper on port 135, and a set of RPC ports (2101, 2103, 2105–2107). An exposed TCP 1801 almost always means the MSMQ Windows feature is installed and running — frequently without anyone intending it — which since 2023 has turned it into a first-class remote target.

Why It’s Open

MSMQ ships as an optional Windows feature, but a lot of enterprise software pulls it in silently as a dependency. Exchange Server, Microsoft Dynamics, and countless .NET line-of-business apps (historically anything built on System.Messaging, NServiceBus, or MassTransit) enable it during install, and plenty of third-party products do the same. Because it’s a component of Windows itself, once the feature is on, mqsvc.exe starts at boot and binds 1801 on every interface by default. Admins rarely notice it’s even listening. MSMQ also rarely travels alone: a host with 1801 open usually exposes RPC on port 135 too, and very often SMB on port 445 — the rest of the Windows attack surface is typically one scan away. When Check Point Research scanned the internet in 2023, roughly 360,000 hosts had 1801 exposed — the vast majority almost certainly by accident.

Common Risks

• Unauthenticated remote code execution (QueueJumper). A single crafted packet to TCP 1801 can execute code in the context of mqsvc.exe, with no authentication at all. That’s CVE-2023-21554, CVSS 9.8 — the headline reason this port matters.
• Exposed by default, no login required. The service binds all interfaces and the MSMQ protocol needs no credentials to reach, so anything that can route to 1801 can talk to it.
• A whole 2023 vulnerability cluster. Microsoft patched roughly 20+ MSMQ CVEs in 2023 — a mix of RCE, denial of service, and information disclosure — so an unpatched host is rarely exposed to just one bug.
• Trivial denial of service. Several bugs crash mqsvc.exe with one malformed packet (for example CVE-2023-21769 and CVE-2023-28302).
• Information disclosure. Memory contents can leak to an unauthenticated attacker (CVE-2023-35383).
• Privileged service context. mqsvc.exe runs with high privileges, so code execution there is a strong foothold for the rest of the host.
• Nobody owns it. Because MSMQ arrives as a dependency, no one deployed it deliberately, no one monitors it, and no one patches it.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and confirm it’s really MSMQ

nmap -sV -p 1801 <target>

Nmap gained a dedicated MSMQ service probe, so -sV can now confirm that an open 1801 is genuinely Microsoft Message Queuing rather than just reporting the port as open.

Scan the full MSMQ port set

nmap -sV -p 135,1801,2101,2103,2105,2107 <target>

Check for QueueJumper with Metasploit

msfconsole -q
use auxiliary/scanner/msmq/cve_2023_21554_queuejumper
set RHOSTS <target>
run

This module sends a crafted MSMQ message with an altered DataLength field; a vulnerable host answers, which flags it as exposed to CVE-2023-21554. It’s a detection/check module, not a weaponised RCE.

Local checks on a Windows host

sc query msmq
Get-Service MSMQ
netstat -ano | findstr :1801
reg query "HKLM\SOFTWARE\Microsoft\MSMQ" /s

Log every host where you confirm MSMQ is listening, plus its patch state, so the evidence lands in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• CVE-2023-21554 — QueueJumper. MSMQ remote code execution, CVSS 9.8 (Critical). A single crafted packet to TCP 1801 triggers a heap out-of-bounds write and executes code in mqsvc.exe — unauthenticated. Disclosed by Check Point Research and fixed on the April 2023 Patch Tuesday. Detectable with Metasploit’s auxiliary/scanner/msmq/cve_2023_21554_queuejumper; the public tooling is a vulnerability check rather than a drop-in exploit.
• CVE-2023-21769 — MSMQ denial of service, CVSS 7.5. An out-of-bounds read lets a remote, unauthenticated attacker crash the MSMQ service.
• CVE-2023-28302 — MSMQ denial of service, CVSS 7.5. Another remote crash bug fixed in the same 2023 patch wave.
• CVE-2023-35383 — MSMQ information disclosure, CVSS 7.5. An integer overflow leaks memory contents to an unauthenticated attacker.

These four are only a slice of the ~20 MSMQ CVEs Microsoft patched across 2023 — patch the whole service and keep it current, don’t chase a single ID.

Mitigation

• Disable MSMQ if you don’t use it. This is the single most effective fix, because most exposed 1801 ports are an unintended dependency nobody needs. Remove the Microsoft Message Queue (MSMQ) Server Windows feature, or stop and disable the Message Queuing service, then rescan to confirm 1801 is closed.
• Patch and stay current. Apply the April 2023 update that fixed QueueJumper and keep up with later fixes — the 2023 MSMQ cluster was patched over several months, so a single update isn’t enough.
• Firewall the MSMQ ports. Never expose 1801 to the internet, and restrict TCP/UDP 1801, RPC 135, and 2101–2107 to trusted application tiers only.
• Restrict and authenticate access. Run MSMQ in Active Directory–integrated mode, apply per-queue ACLs, and enable transport encryption where message contents are sensitive.
• Segment the host. Keep MSMQ servers in an internal zone and treat any internet-facing 1801 as an incident to investigate, not a config to harden in place.

Real-World Example

In April 2023, Check Point Research disclosed QueueJumper (CVE-2023-21554) — a heap-based out-of-bounds write reachable by a single crafted MSMQ packet on TCP 1801, requiring no authentication and yielding code execution as mqsvc.exe. At disclosure, roughly 360,000 hosts had 1801 open to the internet, and most of them were running MSMQ by accident: pulled in by some installer, never used, never firewalled. Microsoft shipped the fix on the April Patch Tuesday alongside a cluster of other MSMQ patches, and internet-wide scanning for 1801 spiked within days. It’s the textbook case for why an “open but unexplained” port deserves attention — nobody deployed MSMQ on purpose, yet everyone running it was one packet away from remote code execution.

FAQ

What is port 1801 used for?

Port 1801 is the default port for Microsoft Message Queuing (MSMQ), a Windows service that lets applications communicate through message queues rather than direct connections. The mqsvc.exe queue manager listens on TCP 1801 (and UDP 1801, plus RPC on port 135 and 2101–2107) to send and receive queued messages between distributed Windows applications.

Is port 1801 dangerous?

It can be. MSMQ is unauthenticated at the protocol level and, since 2023, has been affected by QueueJumper (CVE-2023-21554) — a critical, single-packet remote code execution flaw — plus a wider cluster of RCE, DoS, and information-disclosure bugs. An internet-facing, unpatched port 1801 should be treated as high risk and either patched, firewalled, or disabled.

What is QueueJumper (CVE-2023-21554)?

QueueJumper is a critical MSMQ vulnerability (CVSS 9.8) disclosed by Check Point Research in April 2023. A single crafted packet sent to TCP 1801 triggers a memory-corruption bug that runs attacker code as the mqsvc.exe service, with no authentication required. Microsoft patched it in the April 2023 update; disabling MSMQ if it isn’t needed also removes the exposure.

How do I close port 1801?

If nothing on the host actually uses MSMQ, remove the Message Queuing Windows feature or stop and disable the service, then rescan with nmap -p 1801 <target> to confirm it’s closed. If you do need MSMQ, apply the latest patches and firewall 1801 (and 135, 2101–2107) so only trusted application tiers can reach it.

TL;DR

• Service: MSMQ (Microsoft Message Queuing) via mqsvc.exe
• Default port: 1801/TCP (also UDP 1801, RPC on 135 and 2101–2107)
• Biggest risk: unauthenticated RCE via QueueJumper (CVE-2023-21554, CVSS 9.8), plus a wider 2023 CVE cluster
• Mitigation: disable MSMQ if unused, patch (April 2023 and later), firewall 1801 from untrusted networks