Microsoft Patches Windows Server Zero-Day Crash Flaw CVE-2026-70111

Microsoft has released patches for a critical zero-day vulnerability in Windows Server that allows remote attackers to crash systems. The flaw, tracked as CVE-2026-70111, affects versions 2019, 2022, and 2025 and was fixed in the October 2026 security updates.

What happened

Corelight researchers disclosed a vulnerability in the Windows kernel driver mup.sys on October 13, according to GBHackers. The flaw allows an attacker with network access to crash affected servers using a single malicious Distributed File System referral response, but exploitation requires an initial coercion sequence. Microsoft addressed the issue in its October 2026 updates, and there was no evidence of active exploitation at the time of disclosure.

The vulnerability stems from how mup.sys processes DFS path resolutions. Attackers can coerce a victim system to connect to an attacker-controlled SMB server without needing administrative privileges or domain controller access. This coercion forces the target to request a DFS referral, which the rogue server answers with a crafted payload.

When the victim processes the malicious DFS_REFERRAL_V3 payload, a fault occurs in the kernel. The crash happens within seconds and results in a blue screen. Corelight reproduced the crash across all tests on Windows Server 2022 and all tests on Windows Server 2019.

The underlying defect involves the PktExpandSpecialEntryFromReferral() function. When the ReferralEntryFlags field contains the 0x0002 flag, the function uses ExpandedNameOffset to locate a domain controller name. It then calls wcslen() on the resulting pointer, causing the untrusted pointer dereference.

Why it matters

This vulnerability is significant because it requires no authentication or administrative access to exploit. Attackers can trigger a denial of service by coercing the target to request a DFS referral from a rogue server. The flaw resides in a core kernel driver, meaning the impact is immediate and severe upon exploitation.

The attack vector leverages standard Windows networking features, specifically DFS referrals and SMB connections. This makes it difficult to distinguish malicious traffic from legitimate administrative activity. Systems that are exposed to untrusted networks or poorly segmented internal environments are at higher risk.

Corelight identified the issue while testing for authentication coercion techniques. Instead of capturing credentials, they encountered an unexpected system crash. This highlights how vulnerabilities in network service handlers can lead to stability issues rather than just data breaches.

What to watch

• Monitor system logs for unexpected blue screens or kernel faults in mup.sys.
• Check for spikes in outbound SMB connections to unknown or rogue servers.
• Verify that all Windows Server 2019, 2022, and 2025 instances have the October 2026 updates installed.
• Watch for unusual DFS referral requests or responses in network traffic analysis tools.

Who needs to act first

Teams should prioritize updating servers that are directly accessible from untrusted networks or those handling external DFS referrals. Apply the October 2026 updates to exposed systems first to mitigate the immediate crash risk. Test the updates in a non-production environment to ensure compatibility with existing workloads. Back up critical configurations before deployment to allow for quick rollback if issues arise. Reduce exposure by restricting SMB traffic to trusted sources until all systems are patched.

What to do and how to stay safe: Microsoft

• Apply the October 2026 security updates to all affected Windows Server versions immediately.
• Restrict SMB traffic to known and trusted IP addresses to limit the attack surface.
• Monitor network logs for unusual DFS referral requests or responses from unexpected sources.
• Verify that mup.sys is the patched version after applying the update.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Windows Server versions are affected by CVE-2026-70111?

Windows Server versions 2019, 2022, and 2025 are affected by this vulnerability.

Is there a fix available for this zero-day flaw?

Yes, Microsoft addressed the flaw in its October 2026 security updates.

Do attackers need administrative privileges to exploit this vulnerability?

No, attackers do not need administrative privileges or access to a legitimate domain controller.