NTLM signing security improvements in Windows

What and why

New NTLM signing security improvements address CVE-2026-118737. Starting November 2026, Windows updates enable clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that aren’t using signing. To learn more and prepare for the next phase coming in May of 2027, see NTLM signing security improvements in Windows.

Rollout schedule

• Phase 1 (November 2026): Windows client devices begin offering NTLM signing on all connections by default. Servers accept both signed and unsigned clients. Auditing events identify clients not using signing.
• Phase 2 (May 2027): Windows servers begin requiring NTLM signing by default. Clients that do not offer signing will be rejected by secure servers.

Impact on your organization

These security improvements address the CVE-2026-118737 vulnerability. All supported Windows Server versions are capable of NTLM signing. This rollout simply helps ensure that signing is negotiated and eventually required by default. By May 2027, clients that don’t offer signing will be rejected by secure servers.

Action required/recommendations

1. Install the November 2026 Windows updates or later to reduce exposure to NTLM relay attacks.
2. Audit to identify connections that aren’t using signing. Follow auditing and remediation instructions in NTLM signing security improvements in Windows.
3. Require NTLM signing before it’s enabled by default in May 2027.

Compliance considerations

Consider enforcing signing ahead of May 2027, once auditing confirms readiness, reducing exposure to NTLM relay attacks. Review as appropriate for your organization.