Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response.

This vulnerability, tracked as CVE-2026-70111, affects Windows Server versions 2019, 2022, and 2025. According to Corelight’s disclosure on October 13, Microsoft addressed the flaw in its October 2026 updates. Notably, there was no evidence of active exploitation at the time of disclosure.

The vulnerability resides in mup.sys, a Windows kernel driver that resolves Distributed File System (DFS) paths. Although a single malformed response can trigger the crash, exploitation requires an initial coercion sequence that compels the victim’s system to connect to an attacker-controlled SMB server.

Corelight notes that attackers do not need administrative privileges or access to a legitimate domain controller to exploit this vulnerability.

Windows Server Zero-Day Flaw

Corelight identified the issue while testing Microsoft Remote Procedure Call interfaces and DFS APIs for authentication coercion techniques.

These techniques can force Windows systems to initiate outbound SMB connections, which may expose NTLM authentication to capture or relay. Instead of finding the expected results, researchers encountered an unexpected blue screen during testing of DFS referral responses.

Their investigation focused on the NetDFS management interface, identified by UUID 4fc742e0-4a10-11cf-8273-00aa004ae673. The execution path of this interface leads mup.sys to issue FSCTL_DFS_GET_REFERRALS requests to a domain controller.

Researchers found that an attacker could influence where the response is sent and impersonate the responding server. Researchers reproduced the crash across all 11 tests on Windows Server 2022 and all three tests on Windows Server 2019.

During exploitation, the attacker runs a rogue SMB server and coerces the target into requesting a DFS referral. The rogue server returns a crafted DFS_REFERRAL_V3 payload, and processing that response causes a fault in the victim’s kernel, crashing the entire server within seconds.

The underlying defect involves the processing of NameList referrals inside the PktExpandSpecialEntryFromReferral() function.

When the ReferralEntryFlags field contains the 0x0002 flag, the function uses ExpandedNameOffset to locate a domain controller name and calls wcslen() on the resulting pointer.

Corelight indicates that earlier Windows versions included checks to ensure the expanded name contained at least one character; however, the affected server builds lacked this safeguard.

This oversight lets an offset pointing to an empty WCHAR string reach unsafe processing, causing a kernel null-pointer dereference. Windows 10 retains the necessary checks and, according to the researchers, is therefore not affected.

Automatic rebooting might limit individual outages, but repeated exploitation could keep a server unavailable. Concurrent attacks against domain controllers could lead to substantial disruptions.

Administrators may observe System event log IDs 41 and 6008, indicating an unexpected shutdown. However, these logs may not provide a useful minidump to explain the cause.

Corelight recommends prioritizing patches for DFS-active servers and monitoring internal SMB2 traffic, rather than relying solely on perimeter visibility.

Their detection guidance combines signatures for malformed responses with Zeek connection evidence showing silent sessions that abruptly end and later receive resets.

Clusters of S1, RSTR, or RSTRH connection states involving a single server may indicate a crash-and-recovery sequence. However, they do not confirm exploitation on their own.

Corelight states that its Feed includes detection signatures. The researchers also warn that DFS is one known pathway into the vulnerable driver, and other triggering paths may exist beyond those examined during this investigation.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.