Corelight Researchers Detail Windows Kernel Crash Flaw in CVE-2026-70111

Corelight researchers disclosed a critical Windows Server vulnerability on October 13 that enables remote attackers to crash systems using a single malicious packet. The flaw, tracked as CVE-2026-70111, resides in the Windows Kernel and allows unauthorized users to trigger a system failure without needing administrative privileges.

Microsoft addressed this elevation-of-privilege vulnerability in its October 2026 security updates. According to GBHackers, the patch resolves an untrusted pointer dereference issue that could be abused over a network. Researchers noted there was no evidence of active exploitation at the time of their public disclosure.

Technical Analysis of the Vulnerability

The defect originates in mup.sys, a kernel driver responsible for resolving Distributed File System paths. Corelight identified the issue while testing authentication coercion techniques that force Windows systems to initiate outbound SMB connections. Instead of achieving the expected authentication relay, researchers encountered an unexpected blue screen during their evaluation of DFS referral responses.

Investigation revealed that the NetDFS management interface, identified by UUID 4fc742e0-4a10-11cf-8273-00aa004ae673, leads mup.sys to issue FSCTL_DFS_GET_REFERRALS requests. Attackers can influence where these responses are sent and impersonate the server handling the request. This manipulation allows them to deliver a crafted payload that triggers the kernel fault.

Scope of Affected Systems

The vulnerability impacts Windows Server versions 2019, 2022, and 2025. Corelight reproduced the crash across all eleven tests conducted on Windows Server 2022 and all three tests on Windows Server 2019. The exploitation does not require access to a legitimate domain controller or administrative rights on the target machine.

Attackers run a rogue SMB server and coerce the victim into requesting a DFS referral. The rogue server then returns a specifically crafted DFS_REFERRAL_V3 payload. Processing this response causes a fault in the victim’s kernel, crashing the entire server within seconds. This mechanism highlights the risk of remote coercion techniques in modern Windows environments.

What should you do?

Administrators should verify that all Windows Server instances have received the October 2026 updates. Since the flaw allows remote crashes via network traffic, organizations should monitor for unusual SMB connection patterns that might indicate coercion attempts. Reviewing logs for unexpected DFS referral requests can help identify early signs of exploitation attempts.

What to do and how to stay safe: Microsoft

• Apply the October 2026 Microsoft security updates to all Windows Server 2019, 2022, and 2025 systems immediately.
• Monitor network traffic for unusual SMB connections initiated by servers, which may indicate DFS coercion attempts.
• Review system logs for unexpected DFS referral requests or connections to non-standard domain controllers.
• Restrict outbound SMB traffic from servers to only trusted internal endpoints where possible.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Windows Server versions are affected by CVE-2026-70111?

Windows Server 2019, 2022, and 2025 are affected by this kernel vulnerability.

Is CVE-2026-70111 being actively exploited in the wild?

Corelight stated there was no evidence of active exploitation at the time of their October 13 disclosure.

How can an attacker trigger a crash using this flaw?

Attackers can coerce a server to request a DFS referral from a rogue SMB server that returns a malicious payload.