CVE-2026-34350: Windows Server 2025 DoS Vulnerability

CVE-2026-34350 Overview

CVE-2026-34350 is a null pointer dereference vulnerability [CWE-476] in the Windows Storport Miniport Driver. The flaw affects Microsoft Windows Server 2025 and allows an unauthorized network attacker to trigger a denial of service condition. Successful exploitation requires user interaction, which limits automated mass exploitation. Microsoft published the advisory on May 12, 2026.

The vulnerability impacts availability only. It does not compromise confidentiality or integrity. No public proof-of-concept exists and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A remote, unauthenticated attacker can crash the Storport Miniport Driver and disrupt storage I/O on affected Windows Server 2025 systems, causing service outages.

Affected Products

Microsoft Windows Server 2025
Windows Storport Miniport Driver component
Systems exposing Storport-dependent services over the network

Discovery Timeline

2026-05-12 - CVE-2026-34350 published to NVD
2026-05-12 - Microsoft releases security update via MSRC
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-34350

Vulnerability Analysis

The Storport Miniport Driver (storport.sys) is a Windows kernel-mode storage port driver. It mediates I/O requests between the operating system and storage miniport drivers for SCSI, SAS, and similar adapters. The vulnerability resides in code paths that process attacker-influenced input without validating pointer state before dereference.

When the driver receives a crafted request, it accesses a pointer that has not been initialized or has been set to null under specific conditions. The dereference triggers a bug check (BSOD), terminating system availability. The crash occurs in kernel context, so recovery requires a reboot.

The attack surface is reachable over a network, but the attacker must convince a user to perform an action. This indicates the trigger likely involves a user-initiated connection to an attacker-controlled resource that returns malformed storage protocol data.

Root Cause

The root cause is missing pointer validation [CWE-476] in a Storport request handler. Code dereferences a structure member before confirming it is non-null. Network-supplied input drives execution into the vulnerable branch.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. The user interaction requirement suggests the trigger involves accessing an attacker-controlled storage endpoint, malicious iSCSI target, or similar network storage resource. Once dereferenced, the system halts with a kernel fault.

No public exploit code or proof-of-concept is currently available. See the Microsoft Security Update CVE-2026-34350 advisory for vendor-specific technical details.

Detection Methods for CVE-2026-34350

Indicators of Compromise

Unexpected BSOD events with bug check codes referencing storport.sys or related storage miniport modules
System event log entries showing Event ID 41 (Kernel-Power) following unexplained reboots
Repeated crash dumps in %SystemRoot%\Minidump implicating storage port stack frames
Outbound or inbound connections to untrusted iSCSI, SMB, or storage protocol endpoints preceding crashes

Detection Strategies

Monitor Windows Error Reporting (WER) for crash signatures involving storport.sys
Correlate kernel crash events with prior network connections to external storage targets
Alert on multiple unplanned reboots within a short window across Windows Server 2025 hosts

Monitoring Recommendations

Forward kernel crash telemetry and minidump metadata to a centralized SIEM
Track network connections from servers to non-corporate storage endpoints
Baseline normal reboot patterns to surface anomalous crash clusters

How to Mitigate CVE-2026-34350

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-34350 to all Windows Server 2025 hosts
Inventory Windows Server 2025 systems and prioritize patching for those exposing storage services or accessing external storage endpoints
Train administrators to avoid connecting servers to untrusted iSCSI targets or storage shares until patched

Patch Information

Microsoft published a security update through the MSRC Update Guide. Refer to the Microsoft Security Update CVE-2026-34350 entry for the specific KB article and applicable cumulative update for Windows Server 2025.

Workarounds

Restrict network access to storage protocol ports (iSCSI 3260, SMB 445) using host firewall rules
Block outbound connections from servers to untrusted external storage endpoints at the perimeter
Disable unused storage miniport functionality where operationally feasible
Apply network segmentation to isolate Windows Server 2025 hosts from untrusted networks

bash

# Configuration example: restrict inbound iSCSI access using Windows Firewall
New-NetFirewallRule -DisplayName "Block-Untrusted-iSCSI" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 3260 `
  -RemoteAddress Any `
  -Action Block