NTLM Authentication: Why It Leaks and How to Reduce It

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 11 November 2026.

Part of the Wolfcore Resources library: Ports, protocols and services.

In one sentence: NTLM is an old Windows way of proving who you are, and because it can be tricked into handing over a reusable scrambled copy of your password (a hash), Microsoft is retiring it.

What it is

NTLM (NT LAN Manager) is a family of Windows sign-in protocols. Microsoft describes them as using a challenge and response that proves to a server or domain controller that a user knows the password for an account. It is still used where Kerberos cannot work: systems in a workgroup, and local logon on non-domain controllers. Kerberos is the preferred method in Active Directory, but an application may still use NTLM. See kerberos-authentication.

Microsoft now classes NTLM as deprecated and lists its risks: no server authentication, weak cryptography, and vulnerability to replay, relay and pass-the-hash attacks. A hash is the scrambled form of a password. With NTLM, holding the hash can be enough to sign in, so you do not need the password itself.

How it works

The client asks to connect and the server sends a random challenge.
The client answers with a value calculated from the challenge and the password hash. Microsoft says the resource server must then contact a domain authentication service on the domain controller for domain accounts, or check the local account database for local ones.
If the answer matches, access is granted. The server never proves its own identity, which is why a fake server can collect responses.

The diagram’s lower half shows this week’s Outlook issue. The Register reports that ZDI’s Dustin Childs described a specially crafted message file that, once opened, makes Outlook connect to an attacker-controlled network location without the usual external-content warning, disclosing the user’s NTLMv2 hash, which the attacker can use to authenticate as the user.

Who it affects and how badly

Sole trader to 10 staff: often Microsoft 365 with Windows laptops. Worst case is one stolen sign-in and a hijacked mailbox or file store.
10 to 50 staff (accountancy, legal, recruitment, construction offices): a leaked hash from one user can be used against file servers. Worst case is days of downtime and data theft.
50 to 250 and 250 plus (schools, councils, manufacturers, care providers, fintech): leaked hashes from privileged users are a route to domain-wide compromise. In the UK, EU, US and Armenia, regulated sectors add reporting duties.

Real examples

CVE-2026-124194, November 2026. Microsoft marked this Outlook spoofing flaw as exploited. It is rated Moderate with a CVSS score of 6.5, the weakness is missing warnings about unsafe actions (CWE-356), exploitation needs the user to open the file, and the Preview Pane is not an attack vector. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Microsoft’s advisory does not say who is attacking or at what scale, and The Register notes Microsoft did not say when attacks started or what attackers did after gaining access. A moderate score does not mean low urgency when exploitation is confirmed.

How to detect it

Check which authentication package was used: Security Event ID 4624 shows the authentication package, and the NTLM Operational log records incoming and outgoing NTLM.
On Windows 11 24H2 and 25H2 and Windows Server 2025, switch on enhanced NTLM auditing, which shows who used NTLM, why it was used instead of Kerberos and where it happened.
Run klist on a client. If you expected Kerberos and there is no ticket for the target, NTLM was probably used.
Watch for Outlook or Office making unexpected outbound connections from workstations to addresses outside your business.

How to fix or prevent it

Install the November 2026 security updates for Microsoft 365 Apps or Office LTSC without delay, since this flaw is being exploited.
Turn on NTLM auditing, then list the applications, devices and IP-address connections that still need NTLM. Microsoft’s FAQ says to register missing service principal names, retire NTLMv1 and replace hardcoded NTLM.
Move those applications to Kerberos, using names rather than IP addresses where you can.
Pilot blocking NTLM for privileged accounts and non-critical services first, then widen.
Use separate admin accounts so a leaked hash from a daily account is not an admin hash.
Limit direct outbound file-sharing and other unneeded connections from workstations to the internet at your firewall, as a second line of defence.
Require SMB signing (see smb-signing) and keep Windows patched.
Plan for change: Microsoft says network NTLM will be disabled by default in the next major Windows Server and Windows client releases, with administrators able to re-enable it by policy.

What we check on a test

Whether NTLM is still allowed domain-wide, and whether NTLMv1 is still accepted.
Which services and devices fall back to NTLM and why.
Whether outbound connections to the internet are controlled from user workstations.
Whether SMB signing and other relay protections are required.
Whether privileged accounts are separate and where they sign in.

The UK angle

The NCSC’s lateral movement guidance names pass the hash, where a stolen hash is used to authenticate, as an example of attackers stealing a security token to reach another device. It advises protecting credentials, separate admin accounts and least privilege. On patching, Cyber Essentials v3.3 requires updates within 14 days where they fix critical or high risk vulnerabilities, a CVSS v3 base score of 7 or above, or where the vendor gives no severity, and says an update that covers any critical or high issue must be installed within 14 days. This CVE scores 6.5 on its own, but the same November release includes Critical Office fixes. Patch faster than the minimum when exploitation is confirmed.

Frequently asked questions

Is NTLMv2 safe? Microsoft classes NTLM as deprecated, and the Outlook flaw discloses an NTLMv2 hash that, per Microsoft’s description, an attacker can use to authenticate as the user.

Does the Outlook flaw work from the Preview Pane? According to the reporting on Microsoft’s advisory, no. The user has to open the file.

Is Microsoft removing NTLM? Microsoft says it is being disabled by default in the next major release, not removed outright, and can be re-enabled by policy.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.

NTLM authentication: what it is, why it leaks and how to reduce it