CVE-2026-70111: One-Packet Windows Server DoS via DFS | Corelight

In the process of fuzzing MS-RPC and Distributed File System (DFS) APIs, we discovered a one-packet mechanism set to crash an entire Windows server, which the Microsoft Security Response Center (MSRC) later assigned as CVE-2026-70111 . Corelight customers using the Corelight Feed , a custom ruleset within our Open Network Detection and Response (NDR) Platform that’s designed to swiftly detect and help respond to emerging threats, are already automatically covered with the latest detection for exploitation attempts of this vulnerability.