Microsoft Windows Server Zero-Day Flaw Allows Denial-of-Service via Crafted DFS Referral
A critical zero-day vulnerability in Windows Server, CVE-2026-70111, allows network-adjacent attackers to crash servers by sending a single malicious DFS referral response over SMB.
Microsoft has released a patch for CVE-2026-70111, a zero-day vulnerability affecting Windows Server 2019, 2022, and 2025. The flaw, reported by Corelight researchers, enables a network-adjacent attacker to cause a denial-of-service (DoS) by sending a specially crafted Distributed File System (DFS) referral response over the Server Message Block (SMB) protocol. While not allowing for server takeover, the vulnerability can lead to unexpected server reboots.
The vulnerability stems from a missing length check in the mup.sys driver, a component responsible for handling DFS referrals. When a Windows Server attempts to resolve a DFS path, it queries for referral information via SMB. Corelight discovered that a malformed DFS referral response, specifically a NameList referral with an offset pointing to an empty string, can trigger a vulnerable code path. The server's kernel fails to properly validate this input, leading to an invalid memory reference and a system crash, often manifesting as a blue screen.
Corelight's testing confirmed the repeatability of the crash, successfully reproducing it on 11 out of 11 attempts on Windows Server 2022 and 3 out of 3 attempts on Windows Server 2019. Notably, Windows 10 is not affected, as it retains input validation checks that were absent in the vulnerable Server builds. The primary impact is a denial-of-service, which can disrupt critical services if essential servers like domain controllers are targeted.
While a single crash might result in an automatic server reboot, an attacker capable of repeatedly triggering the flaw could effectively keep a system offline. The extent of the disruption depends on the attacker's network access and the criticality of the targeted servers. Organizations should be aware that evidence of such an attack might be subtle, often appearing as generic Windows System log events like Event ID 41 or 6008, which indicate an unexpected shutdown without specifying a cause.
Microsoft addressed CVE-2026-70111 in its October 2026 security update, released on October 13. The company stated it had not observed signs of active exploitation in the wild prior to the disclosure. Affected organizations are strongly advised to apply the relevant security patches promptly, prioritizing servers that actively utilize DFS functionality.
Beyond patching, Corelight recommends enhanced monitoring of internal SMB traffic, often referred to as "east-west" traffic, between servers and domain controllers. This proactive measure can help detect suspicious activity that might precede or follow a crash. Tools like Zeek can provide insights by logging connection states, where unusual patterns such as sudden session terminations or resets involving a specific server could warrant further investigation.
The disclosure of CVE-2026-70111 underscores the persistent risk posed by overlooked input validation flaws in kernel-level drivers. Even seemingly minor oversights can be weaponized to cause significant service disruption. The incident serves as a reminder for organizations to maintain robust patching schedules and implement comprehensive network monitoring strategies to detect and respond to emerging threats effectively.