CVE-2026-70133 Overview
CVE-2026-70133 is a denial-of-service vulnerability in the Windows Server Message Block (SMB) Server. The flaw stems from the allocation of resources without limits or throttling, classified under [CWE-770]. An unauthenticated remote attacker can send crafted SMB traffic to exhaust server resources and interrupt service availability over the network.
Microsoft published the advisory through the Microsoft Security Response Center. No user interaction or privileges are required to trigger the condition, and the attack reaches the target over the network.
Critical Impact
Unauthenticated remote attackers can exhaust SMB Server resources and cause service disruption on affected Windows systems without any user interaction.
Affected Products
- Windows SMB Server (see Microsoft Security Update Guide CVE-2026-70133 for the authoritative product and build matrix)
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-70133 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-70133
Vulnerability Analysis
The vulnerability resides in the Windows SMB Server component, which handles file, printer, and named pipe sharing over the network. The affected code paths accept and process inbound SMB protocol messages without enforcing adequate limits on the resources those messages consume.
An unauthenticated attacker who can reach TCP port 445 can submit a sequence of SMB requests that cause the server to allocate memory, handles, or compute cycles beyond safe thresholds. Sustained traffic drives the SMB service, and potentially the host, into a degraded or unresponsive state.
Exploitation does not grant code execution or data access. The impact is confined to availability, which aligns with the CVSS vector that marks confidentiality and integrity as unaffected while availability is high.
Root Cause
The root cause is improper enforcement of resource limits in SMB request handling, mapped to [CWE-770] (Allocation of Resources Without Limits or Throttling). Protocol handlers accept attacker-controlled inputs that drive allocation decisions without applying per-connection or per-request ceilings.
Attack Vector
The attack vector is network-based. An attacker establishes connectivity to the SMB service, typically TCP/445, and transmits a stream of SMB messages engineered to force excessive resource allocation. No authentication, privileges, or victim interaction are required.
The vulnerability is described in prose only. Microsoft has not published exploitation code, and no verified proof-of-concept is available at the time of writing. Refer to the Microsoft Security Update Guide CVE-2026-70133 for vendor technical details.
Detection Methods for CVE-2026-70133
Indicators of Compromise
- Spikes in SMB connections or SMB2 request volume from a small number of source IP addresses targeting TCP/445.
- Rapid growth of non-paged pool, handle count, or working set on the LanmanServer service or System process.
- SMB Server event log entries indicating session or resource allocation failures and dropped connections.
- Loss of availability for file shares, Distributed File System (DFS) endpoints, or print services served by the host.
Detection Strategies
- Baseline normal SMB request rates per client and alert on deviations that correlate with host resource pressure.
- Monitor Windows performance counters for Server and Memory objects alongside SMB connection counters to correlate exhaustion patterns.
- Inspect north-south and east-west SMB flows at network sensors to identify unauthenticated clients producing abnormal request patterns.
Monitoring Recommendations
- Forward Windows Security, System, and Microsoft-Windows-SMBServer/Operational logs to a centralized analytics platform.
- Track process-level memory and handle growth for svchost.exe instances hosting the SMB Server service.
- Alert on repeated SMB session setup failures or connection resets from external or untrusted network segments.
How to Mitigate CVE-2026-70133
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-70133 to all affected Windows systems.
- Block inbound TCP/445 from the internet and untrusted networks at perimeter and host firewalls.
- Restrict SMB access to known management and client subnets using network segmentation and access control lists.
Patch Information
Microsoft has released fixes through its monthly security update channel. Consult the Microsoft Security Update Guide CVE-2026-70133 for the specific knowledge base articles, build numbers, and update packages that apply to each affected Windows release. Apply the vendor-supplied patches on all SMB-exposed systems, including domain controllers, file servers, and workstations.
Workarounds
- Enforce Windows Defender Firewall rules that restrict inbound SMB traffic to authorized source addresses only.
- Disable the SMB Server service on hosts that do not require file or printer sharing by stopping and disabling the LanmanServer service.
- Require SMB signing and, where supported, SMB over QUIC with authentication to reduce exposure of the SMB endpoint to arbitrary network clients.
- Place SMB file servers behind VPN or Zero Trust Network Access gateways to remove direct exposure of TCP/445.
# Configuration example: block inbound SMB from untrusted sources on Windows
New-NetFirewallRule -DisplayName "Block Inbound SMB 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block -Profile Public,Domain,Private
# Optional: disable the SMB Server service on hosts that do not need file sharing
Set-Service -Name LanmanServer -StartupType Disabled
Stop-Service -Name LanmanServer -Force
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
