Outlook NTLM Hash Exposure: Audit, Relay, and Patch Tuesday Triage
An exploited Outlook zero-day leaks Windows NTLM authentication hashes in the November 2026 Patch Tuesday release. This short walks the defensive audit path: what the Net-NTLMv2 proof is, why password rotation does not fix a captured response, how relay targets like ADCS change severity, and which controls break the relay. It closes with a triage order for a roughly 1,094-CVE release. Full write-up: https://hackyjs.com/posts/auditing-outlook-ntlm-hash-exposure-from-zero-day-path-to-patch-tuesday-triage
outlookntlmzero-daypatch-tuesdaywindows-security