Microsoft addressed a vulnerability in Windows Server that allows an attacker on the same network to crash a server by manipulating a DFS referral response This article explores addressed vulnerability windows. . Corelight researchers discovered the issue while testing the Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces.

An attacker requires network access to cause the target to connect to a malicious SMB server, which triggers a malformed DFS referral that crashes the service, potentially taking seconds. Corelight discovered that a crafted response can reach a vulnerable code path while the driver processes a DFS referral. Frequent crashes of critical systems, like domain controllers, can disrupt crucial services across an organization.

Corelight notes that reboots may leave little trace beyond Windows System log Event IDs 41 and 6008, which indicate an unexpected shutdown without explaining the cause. Microsoft's October 2026 security update, released October 13, targets vulnerabilities on Windows Server 2019, 2022, and 2025. Corelight recommends monitoring internal, or "east-west," SMB traffic between servers and domain controllers, not just perimeter traffic.

Its researchers note that Zeek connection logs may indicate sessions becoming silent during a crash and resuming activity after the server restarts. Their earlier report on Windows denial-of-service vulnerabilities provides related context on service availability risks. CVE-2026-70111 demonstrates how an overlooked input check in a kernel driver can turn a network response into a server outage.