---
title: Tip: the Outlook zero-day only pays off if NTLM leaves your network, so block outbound SMB and restrict outgoing NTLM | ctxsec
url: https://ctxsec.com/items/tip-block-outbound-smb-and-ntlm-before-outlook-cve-2026-124194-patch
description: "CVE-2026-124194 turns opening a file into a leaked NTLMv2 hash. Three controls blunt the whole bug class while the Office update rolls out: block TCP 445 outbound at the perimeter and on host firewalls, turn on SMB client NTLM blocking where the OS supports it, and audit, then restrict, outgoing NTLM to remote servers."
status: "operational guidance (Microsoft documentation; mitigations for an NTLM-disclosure bug, not a replacement for the Office update)"
published: 2026-11-10
---

> CVE-2026-124194 turns opening a file into a leaked NTLMv2 hash. Three controls blunt the whole bug class while the Office update rolls out: block TCP 445 outbound at the perimeter and on host firewalls, turn on SMB client NTLM blocking where the OS supports it, and audit, then restrict, outgoing NTLM to remote servers.

[← Tips & Guides](/tips) · [markdown](/items/tip-block-outbound-smb-and-ntlm-before-outlook-cve-2026-124194-patch.md)

operational guidance (Microsoft documentation; mitigations for an NTLM-disclosure bug, not a replacement for the Office update)

2026-11-10

### Tip: the Outlook zero-day only pays off if NTLM leaves your network, so block outbound SMB and restrict outgoing NTLM

- **Perimeter and host firewall:** deny outbound TCP 445 and 139 to the internet; most organizations never need it.
- **SMB NTLM blocking:** Windows 11 24H2 and Windows Server 2025 can stop the SMB client from sending NTLM to remote servers, with exceptions for servers that still need it.
- **Restrict NTLM: Outgoing NTLM traffic to remote servers:** start with _Audit all_ to see what breaks, add exceptions, then move to _Deny all_ for high-value users.
- Put admins in Protected Users (no NTLM), and require SMB signing and EPA so a relayed hash can't be used against internal services.
- Then confirm Outlook's build actually changed: LTSC 2024 16.0.17932.21140, LTSC 2021 16.0.14334.21048, Current Channel 20527.20196.

Sources: [Microsoft Learn: SMB NTLM blocking](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking) · [Microsoft Learn: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers) · [MSRC Security Update Guide: CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194) · [Microsoft Learn: Release notes for Microsoft Office security updates (Nov 10, 2026)](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)