Microsoft: December security updates cause Message Queuing failures

Microsoft acknowledged that its December 2025 Patch Tuesday security updates (KB5071546, KB5071544, KB5071543) are breaking Message Queuing (MSMQ) on Windows 10 22H2, Windows Server 2019 and 2016, producing inactive queues, IIS sites failing with “insufficient resources” errors and applications unable to write to queues (sometimes showing misleading disk‑space messages). The root cause is a change to the MSMQ security model and NTFS permissions on C:\Windows\System32\MSMQ\storage that now requires MSMQ users to have write access (administrative accounts are unaffected); clustered MSMQ under load is also impacted. Microsoft is investigating with no fix timeline yet; affected admins may need to consider rolling back the updates at the cost of reintroducing security exposure, posing immediate operational risk for enterprise apps and IIS-hosted services that rely on MSMQ.

Analysis

Microsoft confirmed that its December 2025 Patch Tuesday security updates (KB5071546, KB5071544, KB5071543) are breaking Message Queuing (MSMQ) functionality on Windows 10 22H2, Windows Server 2019 and Windows Server 2016. Reported symptoms include inactive MSMQ queues, IIS sites failing with “insufficient resources” errors, applications unable to write to queues, and misleading disk-space warnings despite available resources.

Microsoft attributes the issue to security model changes that altered NTFS permissions on C:\Windows\System32\MSMQ\storage, now requiring MSMQ users to have write access; accounts with full administrative privileges are unaffected. Clustered MSMQ environments under load are specifically called out as impacted, and Microsoft has not provided a timeline for a fix or said whether an out-of-cycle emergency patch will be issued.

Administrators face an operational trade-off: rolling back the updates can restore service but reintroduces security exposure — notable given Microsoft’s April 2023 advisory on a critical MSMQ vulnerability. The disruption creates immediate availability and support risks for enterprise applications and IIS-hosted services that rely on MSMQ, producing mildly negative sentiment toward Microsoft but limited apparent systemic market impact at this stage.

Key Decisions for Investors

• Monitor Microsoft’s official advisory and timeline closely and require confirmatory QA testing before reapplying or rolling back KB5071546/KB5071544/KB5071543 on Windows 10 22H2 and Server 2019/2016 systems
• Inventory and quantify MSMQ and IIS dependence across portfolio companies to assess potential revenue or margin pressure from outages and remediation costs
• If MSFT exposure is material, consider short-duration hedges or reduced position size to reflect near-term operational risk, but avoid large directional moves absent broader evidence of sustained impact