A newly disclosed Windows Server zero-day vulnerability lets attackers with network access crash affected systems with a single malicious Distributed File System (DFS) referral response.
Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025. Corelight says Microsoft released fixes on October 13 through its October 2026 updates, with no active exploitation observed at disclosure.
The vulnerability resides in mup.sys, a Windows kernel driver that resolves DFS paths. Exploitation requires neither administrative privileges nor a compromised legitimate domain controller.
Windows Server Zero-Day Flaw
However, the single-packet description refers to the crash-triggering response, not the entire attack sequence: attackers must first coerce the target into communicating with an attacker-controlled SMB server.
Corelight’s Travis Green and Labs Team discovered the issue while investigating authentication coercion techniques across Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces.
Their original objective was to identify ways to force servers into outbound SMB connections that could expose NTLM authentication for capture or relay.
Travis Green examined the NetDFS management interface, identified by UUID 4fc742e0-4a10-11cf-8273-00aa004ae673. Its execution chain causes mup.sys to issue FSCTL_DFS_GET_REFERRALS requests toward a domain controller.
By influencing the destination and fuzzing responses from an impersonated server, Travis Green unexpectedly triggered kernel crashes. Testing reproduced the failure in all 11 attempts against Windows Server 2022 and all three attempts against Windows Server 2019.
During exploitation, a rogue SMB server returns a crafted DFS_REFERRAL_V3 payload after the victim requests a referral. The vulnerable driver processes a NameList referral through PktExpandSpecialEntryFromReferral(), using ExpandedNameOffset to locate a domain controller name before calling wcslen().
Earlier Windows builds checked whether the expanded name contained characters. According to Corelight, affected Server builds lacked that guard.
An offset pointing to an empty WCHAR string therefore reaches unsafe processing, causing a kernel null-pointer dereference and blue-screen crash within seconds. Windows 10 retains the relevant checks and is unaffected.
Automatic rebooting may shorten individual outages, but repeated exploitation could keep servers unavailable. Simultaneously targeting domain controllers could severely disrupt organizational operations.
Mitigation
Administrators may see System event IDs 41 and 6008 following unexpected shutdowns, without a useful minidump explaining the fault. Corelight recommends prioritizing updates for DFS-active servers and monitoring internal SMB2 traffic, since perimeter-only visibility can miss exchanges occurring entirely inside the network.
Corelight Feed includes Suricata signatures for malformed responses. Zeek conn.log can provide supporting evidence through clusters of S1 sessions followed by RSTR or RSTRH states during recovery.
These patterns indicate interrupted connections and subsequent resets, but do not independently prove exploitation. Applying Microsoft’s fixes remains the primary remediation; detection coverage does not replace prompt patching of affected servers.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
%20referral%20response.){kind=link}