Threat reportVulnerabilityTL-2026-3491
Windows Server DFS Zero-Day Denial of Service via Malformed DFS_REFERRAL_V3 (CVE-2026-70111)
Windows Server DFS Zero-Day Denial of Service via Malformed (TL-2026-3491) is a high-severity software vulnerability scored CVSS 8.1, first published 2026-10-14 and last reviewed 2026-10-16. It has no confirmed attribution, affects Microsoft Windows Server, references 1 CVE (CVE-2026-70111), maps to 6 MITRE ATT&CK techniques (T1021.002, T1187, T1210), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3491
- Threat ID
- TL-2026-3491
- Severity
- HIGH
- CVSS
- 8.1
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, education, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
- Updates
- 2026-10-16 · revalidated 1× · latest source
How Windows Server DFS Zero-Day Denial of Service via Malformed works
CVE-2026-70111 is a missing length check in the Windows kernel driver mup.sys that lets a malformed DFS_REFERRAL_V3 NameList referral trigger a kernel null-pointer dereference and an immediate BSOD on Windows Server 2019, 2022 and 2025. Exploitation needs a rogue SMB server and a coerced victim connection, with no privileges. Microsoft patched it in the October 2026 updates, and no active exploitation was observed at disclosure.
Corelight disclosed CVE-2026-70111 on 2026-10-13, the same day Microsoft shipped the fix in its October 2026 updates. The researchers found it while testing Microsoft RPC interfaces and DFS APIs, and Corelight describes the finding as fuzzing-derived.
Root cause: the mup.sys function PktExpandSpecialEntryFromReferral() handles DFS referral entries whose ReferralEntryFlags field has the 0x0002 (NameList referral) bit set. It uses ExpandedNameOffset to locate a domain controller name and calls wcslen() on the resulting pointer. Earlier Windows builds checked that the expanded name held at least one character. The affected Server builds lack that guard, a length check that was removed. A DFS_REFERRAL_V3 response whose ExpandedNameOffset points at an empty WCHAR string (0x00 0x00) therefore reaches unsafe processing and causes a kernel null-pointer dereference. The related weakness is NULL pointer dereference (CWE-476) with insufficient input validation; the sources do not state a CWE, so this is an analyst mapping. Windows 10 is not affected because it retains the check.
Attack flow: the attacker runs a rogue SMB server and coerces the target Windows Server into connecting and requesting a DFS referral. The rogue server returns the crafted DFS_REFERRAL_V3 payload and the target crashes within seconds. No administrative privileges and no domain controller compromise are needed. Corelight reports 11/11 reproductions on Server 2022 and 3/3 on Server 2019. The crash can be repeated against the same target for sustained denial of service. Corelight references the NetDFS management interface (MS-DFSNM, UUID 4fc742e0-4a10-11cf-8273-00aa004ae673) in its analysis. The impact is availability only: no code execution or data disclosure is reported.
Status: neither source reports active exploitation. No formal public PoC was released, but the exploitation method is described publicly. Neither source states a CVSS score, so cvss_score is null; the MEDIUM severity is an analyst estimate for a DoS-only impact, not a source-stated value. CISA KEV did not list the CVE as of this research.
Detection: Corelight Feed ships Suricata signatures for malformed DFS_REFERRAL_V3 packets. In Zeek conn.log, clusters of conn_state S1, RSTR or RSTRH from the same server can indicate exploitation attempts. After a crash, Windows System log shows Event ID 41 (Kernel-Power) and Event ID 6008 (unexpected shutdown), and typically no minidump or clear crash reason is recorded. Corelight advises prioritizing patches for DFS-active servers and monitoring internal SMB2 traffic rather than relying on perimeter visibility.
MITRE ATT&CK techniques used in TL-2026-3491
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1210 Exploitation of Remote Services
Credential Access
Impact
T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1529 System Shutdown/Reboot
Affected products and versions in Windows Server DFS Zero-Day Denial of Service via Malformed
Remediation for Windows Server DFS Zero-Day Denial of Service via Malformed
Patches
- Microsoft October 2026 cumulative security updates (released 2026-10-13) for Windows Server 2019, 2022 and 2025
Immediate actions
- Apply the October 2026 Microsoft security updates to Windows Server 2019, 2022 and 2025, prioritizing DFS-active servers
- Hunt for Event ID 41 and 6008 reboots on servers with no maintenance or admin action
- Alert on clusters of Zeek conn_state S1, RSTR and RSTRH from the same server
Workarounds
- No vendor workaround stated in the sources; limit outbound SMB from servers to trusted file servers only
Longer-term hardening
- Monitor internal east-west SMB2 traffic, not only perimeter traffic
- Deploy Suricata rules for malformed DFS_REFERRAL_V3 packets, such as the Corelight Feed ruleset
- Restrict which SMB servers Windows Servers may reach, and block outbound SMB (TCP 445) to untrusted hosts
CVEs associated with Windows Server DFS Zero-Day Denial of Service via Malformed
Weaknesses (CWE) in Windows Server DFS Zero-Day Denial of Service via Malformed
Timeline of Windows Server DFS Zero-Day Denial of Service via Malformed
- CVE-2026-70111 is published in NVD with CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-822; record status is Awaiting Analysis.
- Microsoft MSRC assigns CVE-2026-70111 and classifies it as a privilege-escalation-type Windows Kernel issue, although Corelight's analysis demonstrates only a remote kernel crash.
- Corelight publishes detection guidance: Suricata signatures for malformed DFS_REFERRAL_V3 packets and Zeek conn_state S1, RSTR and RSTRH clustering.
- Corelight reports no active exploitation at publication and 11/11 (Server 2022) and 3/3 (Server 2019) reproducibility in testing.
- Microsoft releases the October 2026 updates that fix the flaw in Windows Server 2019, 2022 and 2025.
- Corelight publicly discloses CVE-2026-70111, a malformed DFS_REFERRAL_V3 kernel null-pointer dereference in mup.sys, found while testing Microsoft RPC interfaces and DFS APIs.
- Threadlinqs hunt flags the threat as a detection-engineering candidate; CISA KEV did not list the CVE at that time.
- GBHackers reports the flaw, stating there was no evidence of active exploitation at disclosure and that no formal PoC was released.
- Cyber Security News reports the flaw as a Windows Server 0-day that lets attackers crash servers with a single packet.
Update history for TL-2026-3491
- 2026-10-16 — Windows Server DFS Client (mup.sys) 0-Day CVE-2026-70111 - Remote Kernel Crash via Malformed DFS Referral Response: What changed cvss_score null → 8.1 (NVD, CNA-supplied, Awaiting Analysis); severity MEDIUM → HIGH, since the earlier MEDIUM was an analyst estimate made when no score existed. Exploitability stays THEORETICAL and status stays PATCHED; neith
Sources cited for Windows Server DFS Zero-Day Denial of Service via Malformed
- One-Packet Windows Server DoS via DFS (CVE-2026-70111)
- Windows Server Zero-Day Flaw Lets Attackers Crash Servers With a Single Malicious Packet
- MSRC Security Update Guide: CVE-2026-70111
- NVD: CVE-2026-70111
- CISA Known Exploited Vulnerabilities Catalog (CVE not listed at research time)
- MS-DFSNM: Distributed File System (DFS): Namespace Management Protocol
- MS-DFSC: DFS Referral Protocol (DFS_REFERRAL_V3 structure)
Detection coverage for TL-2026-3491
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3491 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.