Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet

Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025.

Corelight researchers reported the issue after finding it while testing Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces. The company said it had not seen signs of active exploitation when it disclosed the flaw on October 13, 2026.

The vulnerability poses a denial-of-service risk, not server takeover. An attacker needs network access to make the target connect to a malicious SMB server, which returns a malformed DFS referral that crashes the service a process Corelight says can take seconds.

Windows uses DFS to direct users and systems to files stored across a network. When a Windows Server resolves a DFS path, a component called mup.sys requests referral information over SMB. Corelight found that a crafted response can reach a vulnerable code path while the driver processes a DFS referral.

The reported cause is a missing length check. In a particular NameList referral, an offset can point to an empty string. The server code does not reject that value before processing it, and the kernel can hit an invalid memory reference. The result is a blue screen and an unexpected reboot.

Corelight reproduced the crash 11 out of 11 times on Windows Server 2022 and 3 out of 3 times on Server 2019. Those results show the issue was repeatable in the researchers’ lab.

Microsoft Windows Server 0-Day Flaw

However, they don’t show how often organizations use it. Corelight said Windows 10 is not affected because it retains checks absent from the affected Server builds.

Windows Server may restart automatically after a kernel fault, which can limit the length of a single disruption. However, an attacker who can repeatedly trigger the flaw may keep a system offline.

The impact depends on which servers are reachable and targeted. Repeated crashes of important systems, such as domain controllers, could disrupt key services across an organization.

Corelight says reboots may leave little evidence beyond Windows System log Event IDs 41 and 6008, which indicate an unexpected shutdown without explaining the cause, making network monitoring essential to identify activity before and after the crash.

Microsoft’s October 2026 security update, released October 13, addresses CVE-2026-70111 on Windows Server 2019, 2022, and 2025. Organizations should apply the relevant update and prioritize servers that actively use DFS.

Corelight advises monitoring internal, or “east-west,” SMB traffic between servers and domain controllers, not only traffic crossing the perimeter.

Its researchers say Zeek connection logs may show sessions going silent during a crash and reset activity after the server returns. A sudden cluster of connection states such as S1, RSTR, or RSTRH involving the same Server may merit investigation. However, those signs alone do not prove exploitation.

For more background on Windows authentication coercion, see Cyber Security News’ coverage of Windows authentication coercion attacks.

Its earlier report on Windows denial-of-service vulnerabilities offers related context on service availability risks. CVE-2026-70111 shows how an overlooked input check in a kernel driver can turn a network response into a server outage.

Patching affected systems and monitoring internal SMB transactions are key steps to reduce the risk. The technical findings and patch details are described in Corelight’s disclosure.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet appeared first on Cyber Security News.