---
title: Hunt: Outlook reaching out over SMB or WebDAV to an outside host right after a user opens a message file | ctxsec
url: https://ctxsec.com/items/hunt-outlook-cve-2026-124194-ntlm-leak-outbound-smb-webdav-from-outlook
description: "Microsoft's description gives the shape of CVE-2026-124194: a crafted message file is opened, Outlook connects to an attacker-controlled network location with no external-content warning, and Windows sends the user's NTLMv2 response. That leaves network and authentication traces you can hunt for now, before every endpoint has the Office fix."
status: "detection guidance built from Microsoft's CVE-2026-124194 description; Microsoft has not published IOCs or attack details"
published: 2026-11-10
---

> Microsoft's description gives the shape of CVE-2026-124194: a crafted message file is opened, Outlook connects to an attacker-controlled network location with no external-content warning, and Windows sends the user's NTLMv2 response. That leaves network and authentication traces you can hunt for now, before every endpoint has the Office fix.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-outlook-cve-2026-124194-ntlm-leak-outbound-smb-webdav-from-outlook.md)

detection guidance built from Microsoft's CVE-2026-124194 description; Microsoft has not published IOCs or attack details

2026-11-10

### Hunt: Outlook reaching out over SMB or WebDAV to an outside host right after a user opens a message file

- **Network:** OUTLOOK.EXE (or the WebClient service, svchost hosting `WebClient`, for WebDAV) opening TCP 445, 139 or 80/443 WebDAV connections to internet addresses. Workstations shouldn't speak SMB to the internet at all, so any allowed outbound 445 is a lead.
- **Files:** `.msg` or other Outlook item attachments delivered from external senders, and Outlook opening a file from %TEMP% or the Outlook secure temp folder (`Content.Outlook`) shortly before the outbound connection.
- **Authentication:** with outgoing NTLM auditing enabled, Microsoft-Windows-NTLM/Operational events show NTLM sent to remote servers; look for targets that are IP addresses or domains outside your estate.
- **Follow-on:** logons for the same user from new IPs or relayed NTLM authentications to internal services (Exchange, ADCS web enrollment, SMB servers without signing) soon after.
- If you find a hit, reset the user's password; a captured NTLMv2 response can be cracked offline.

Sources: [MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194) · [Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers)