A zero-day vulnerability has recently been disclosed by Travis Green and the Corelight Labs team while testing Microsoft’s DFS and MS-RPC interfaces. It affects mup.sys, a Windows kernel driver that is responsible for processing file-system paths, including Distributed File System (DFS) paths.

It allows an attacker with network access to connect to an attacker-controlled SMB server. With this blog, we understand what the vulnerability is about, the threat it poses, and what organizations should do.

About the vulnerability

The Windows kernel driver (‘mup.sys’) fails to properly validate empty name in a specially crafted DFS referral response. This missing validation can cause the driver to access an invalid memory location and crash the system resulting in Blue Screen of Death (BSOD).

What can attackers do with the vulnerability?

An attacker can exploit the vulnerability to:

• Crash the Windows servers, triggering the Blue Screen of Death (BSOD) and forcing the server to restart.
• Disrupt services by repeatedly crashing the affected servers.
• Disrupt domain operations and severely affect network authentication and other domain services.
• Remotely crash the affected Windows Servers without administrative privileges.

SharkStriker’s recommendations

• Prioritize patching Windows Server 2019, 2022, and 2025 systems affected by CVE-2026-70111.
• Identify domain controllers and other business-critical servers that process DFS referrals and prioritize their remediation.
• Verify successful installation of the applicable October 2026 security updates through endpoint management and vulnerability assessment tools.
• Review network security controls governing SMB traffic and restrict unnecessary SMB communications between systems.
• Monitor for unexpected server crashes, repeated reboots, and unusual DFS/SMB activity.
• Correlate network telemetry with Windows System logs to investigate suspected exploitation attempts.
• Maintain a documented remediation plan and track exceptions for systems that cannot be patched immediately.

SharkStriker’s actions

• Reviewed the vulnerability disclosure published by Corelight and supporting security research.
• Identified affected Windows Server versions and the availability of Microsoft’s October 2026 security update.
• Recommended prioritizing patch assessment and remediation for affected server infrastructure.
• Recommended monitoring for abnormal server restarts and suspicious SMB/DFS communication patterns.