Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet
Microsoft patched CVE-2026-70111, a Windows Server DFS flaw that can crash servers with one malicious SMB response.
Corelight disclosed CVE-2026-70111, a denial-of-service flaw in Windows Server 2019, 2022, and 2025. A network-adjacent attacker who causes a server to contact a malicious SMB host can return a malformed DFS referral; a missing length check in mup.sys then triggers a kernel crash and reboot. Corelight reproduced the crash reliably in the lab, while Microsoft said it had seen no active exploitation when it patched the bug on October 13, 2026. Windows 10 is not affected.
- Missing length check in mup.sys can blue-screen the server.
- Attacker must induce a connection to a malicious SMB server.
- Microsoft reported no active exploitation at the October 13 patch.
- Windows 10 is unaffected; Server 2019, 2022, and 2025 are patched.
Vulnerabilities mentionedAll →
- CVE-2026-701118.1—Untrusted pointer dereference in Windows Kernel (network privesc)published · Microsoft Windows Kernel
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-70111 | Untrusted pointer dereference in Windows Kernel (network privesc) CVE-2026-70111 is an untrusted pointer dereference (CWE-822) in the Microsoft Windows Kernel. Microsoft rates it 8.1 (high): a remote, unauthenticated attacker needs no user interaction, but attack complexity is high, and successful exploitation can elevate privileges with high impact to confidentiality, integrity, and availability. A related headline describes a Windows Server issue in which a single packet can crash servers; the CVE text itself states network privilege elevation rather than naming a packet or a fixed product build. Affected kernel versions are not listed in the supplied data, so any Windows installation that includes the vulnerable kernel code should be treated as in scope until Microsoft's advisory is checked. It is not on the CISA KEV list and no public proof-of-concept is known. |
Full article595 words · extracted from cybersecuritynews.com · click to collapse
Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025.
Corelight researchers reported the issue after finding it while testing Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces. The company said it had not seen signs of active exploitation when it disclosed the flaw on October 13, 2026.
The vulnerability poses a denial-of-service risk, not server takeover. An attacker needs network access to make the target connect to a malicious SMB server, which returns a malformed DFS referral that crashes the service a process Corelight says can take seconds.
Windows uses DFS to direct users and systems to files stored across a network. When a Windows Server resolves a DFS path, a component called mup.sys requests referral information over SMB. Corelight found that a crafted response can reach a vulnerable code path while the driver processes a DFS referral.
The reported cause is a missing length check. In a particular NameList referral, an offset can point to an empty string. The server code does not reject that value before processing it, and the kernel can hit an invalid memory reference. The result is a blue screen and an unexpected reboot.
Corelight reproduced the crash 11 out of 11 times on Windows Server 2022 and 3 out of 3 times on Server 2019. Those results show the issue was repeatable in the researchers’ lab.
Microsoft Windows Server 0-Day Flaw
However, they don’t show how often organizations use it. Corelight said Windows 10 is not affected because it retains checks absent from the affected Server builds.
Windows Server may restart automatically after a kernel fault, which can limit the length of a single disruption. However, an attacker who can repeatedly trigger the flaw may keep a system offline.
The impact depends on which servers are reachable and targeted. Repeated crashes of important systems, such as domain controllers, could disrupt key services across an organization.
Corelight says reboots may leave little evidence beyond Windows System log Event IDs 41 and 6008, which indicate an unexpected shutdown without explaining the cause, making network monitoring essential to identify activity before and after the crash.
Microsoft’s October 2026 security update, released October 13, addresses CVE-2026-70111 on Windows Server 2019, 2022, and 2025. Organizations should apply the relevant update and prioritize servers that actively use DFS.
Corelight advises monitoring internal, or “east-west,” SMB traffic between servers and domain controllers, not only traffic crossing the perimeter.
Its researchers say Zeek connection logs may show sessions going silent during a crash and reset activity after the server returns. A sudden cluster of connection states such as S1, RSTR, or RSTRH involving the same Server may merit investigation. However, those signs alone do not prove exploitation.
For more background on Windows authentication coercion, see Cyber Security News’ coverage of Windows authentication coercion attacks.
Its earlier report on Windows denial-of-service vulnerabilities offers related context on service availability risks. CVE-2026-70111 shows how an overlooked input check in a kernel driver can turn a network response into a server outage.
Patching affected systems and monitoring internal SMB transactions are key steps to reduce the risk. The technical findings and patch details are described in Corelight’s disclosure.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.