CVE-2026-70348: Windows Management Services DOS Flaw

CVE-2026-70348 Overview

CVE-2026-70348 is a link following vulnerability [CWE-59] in Windows Management Services. An authorized local attacker can exploit improper link resolution before file access to cause a denial of service condition on the affected host. The flaw requires local access and low privileges, and it does not require user interaction.

Microsoft published the advisory on 2026-08-11, and the entry was last modified on 2026-08-12. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An authorized local attacker can trigger a denial of service in Windows Management Services by abusing symbolic or hard link resolution, disrupting system availability.

Affected Products

Microsoft Windows (Windows Management Services component)
Specific Windows versions and builds are enumerated in the Microsoft Security Response Center advisory
Refer to the Microsoft CVE-2026-70348 Update Guide for the authoritative product list

Discovery Timeline

2026-08-11 - CVE-2026-70348 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70348

Vulnerability Analysis

The vulnerability resides in the Windows Management Services component and is classified under [CWE-59] Improper Link Resolution Before File Access, commonly referred to as link following. The service resolves file paths without adequately validating whether the target is a symbolic link, junction, or hard link controlled by a lower-privileged user.

Exploitation causes the service to operate on an attacker-designated target file rather than the intended resource. The resulting impact is limited to availability. Confidentiality and integrity are not affected according to the CVSS vector.

Because the attack vector is local and requires low privileges, an attacker must already be able to execute code as a standard user on the target host. No user interaction is needed, and the attack complexity is low.

Root Cause

The root cause is missing or insufficient validation during file access operations performed by Windows Management Services. When the service opens or writes to a file in a user-writable directory, it follows filesystem links without verifying the final target. An attacker plants a link that redirects the operation to a critical file, causing corruption or lock contention that leads to service disruption.

Attack Vector

An attacker with local, authenticated access creates a symbolic link, mount point, or hard link in a location that Windows Management Services accesses. When the privileged service resolves the path, it acts on the attacker-controlled target. Repeated or targeted abuse forces the service or dependent components into a failed state, producing a denial of service.

No verified public exploitation code exists for this vulnerability. See the Microsoft CVE-2026-70348 Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-70348

Indicators of Compromise

Unexpected termination or repeated restarts of Windows Management Services processes on the host
Creation of symbolic links, junctions, or hard links by non-administrative users in directories accessed by system services
Windows Event Log entries showing access denied or file corruption errors originating from management service accounts

Detection Strategies

Monitor for the CreateSymbolicLink and CreateHardLink API calls invoked by non-administrative processes targeting directories used by system services
Alert on NtCreateFile operations from privileged services that resolve paths containing reparse points in user-writable locations
Correlate service crash events (Event ID 7031, 7034) with recent filesystem link creation activity from the same user session

Monitoring Recommendations

Enable Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) to capture link creation activity across user profile directories
Baseline normal Windows Management Services file access patterns and alert on deviations involving reparse points
Aggregate service availability metrics and Windows Event Log data in a centralized SIEM for correlation across endpoints

How to Mitigate CVE-2026-70348

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70348 Update Guide as soon as it is available for your Windows build
Inventory hosts running Windows Management Services and prioritize patching for multi-user systems where local accounts exist
Restrict standard user permissions to create symbolic links by reviewing the SeCreateSymbolicLinkPrivilege assignment

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-70348 Update Guide to identify the correct cumulative update or security-only package for each affected Windows version and deploy it through Windows Update, WSUS, or a managed patch pipeline.

Workarounds

Limit local logon rights on servers running Windows Management Services to trusted administrative accounts only
Remove SeCreateSymbolicLinkPrivilege from standard user groups where it is not required for business operations
Apply file system auditing to service working directories to detect link creation attempts before exploitation succeeds

bash

# Configuration example
# Review accounts holding SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg

# Enable auditing on a service working directory
auditpol /set /subcategory:"File System" /success:enable /failure:enable