What and why:
New NTLM signing security improvements address
CVE-2026-118737. Starting November 2026, Windows updates enable clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that aren’t using signing. To learn more and prepare for the next phase coming in May of 2027, see
NTLM signing security improvements in Windows.
Rollout schedule:
- Phase 1 (November 2026): Windows client devices begin offering NTLM signing on all connections by default. Servers accept both signed and unsigned clients. Auditing events identify clients not using signing.
- Phase 2 (May 2027): Windows servers begin requiring NTLM signing by default. Clients that do not offer signing will be rejected by secure servers.
Impact on your organization:
These security improvements address the
CVE-2026-118737 vulnerability. All supported Windows Server versions are capable of NTLM signing. This rollout simply helps ensure that signing is negotiated and eventually required by default. By May 2027, clients that don’t offer signing will be rejected by secure servers.
Action required/recommendations:
- Install the November 2026 Windows updates or later to reduce exposure to NTLM relay attacks.
- Audit to identify connections that aren’t using signing. Follow auditing and remediation instructions in NTLM signing security improvements in Windows.
- Require NTLM signing before it’s enabled by default in May 2027.
Compliance considerations:
Consider enforcing signing ahead of May 2027, once auditing confirms readiness, reducing exposure to NTLM relay attacks. Review as appropriate for your organization.