Tip: the Outlook zero-day only pays off if NTLM leaves your network, so block outbound SMB and restrict outgoing NTLM
- Perimeter and host firewall: deny outbound TCP 445 and 139 to the internet; most organizations never need it.
- SMB NTLM blocking: Windows 11 24H2 and Windows Server 2025 can stop the SMB client from sending NTLM to remote servers, with exceptions for servers that still need it.
- Restrict NTLM: Outgoing NTLM traffic to remote servers: start with Audit all to see what breaks, add exceptions, then move to Deny all for high-value users.
- Put admins in Protected Users (no NTLM), and require SMB signing and EPA so a relayed hash can't be used against internal services.
- Then confirm Outlook's build actually changed: LTSC 2024 16.0.17932.21140, LTSC 2021 16.0.14334.21048, Current Channel 20527.20196.
Sources: Microsoft Learn: SMB NTLM blocking · Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers · MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability · Microsoft Learn: Release notes for Microsoft Office security updates (Nov 10, 2026)