Vulnerability record · CVE-2019-1040 · published 12 June 2019
CVE-2019-1040: Windows NTLM MIC bypass allows security downgrade
Microsoft · Windows 10
Microsoft Windows fails to properly enforce NTLM Message Integrity Check (MIC) protection, letting a man-in-the-middle tamper with NTLM packets and modify flags without invalidating the signature. This matters because NTLM MIC is a defense against NTLM relay and downgrade attacks, so bypassing it reopens those paths on unpatched systems.
Description
A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. To exploit this vulnerability, the attacker would need to tamper with the NTLM exchange. The attacker could then modify flags of the NTLM packet without invalidating the signature. The update addresses the vulnerability by hardening NTLM MIC protection on the server-side.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Automated analysis
high priorityHigh EPSS probability and broad Windows exposure outweigh the medium CVSS score, though exploitation requires a man-in-the-middle position and user interaction.
What it is
Microsoft Windows fails to properly enforce NTLM Message Integrity Check (MIC) protection, letting a man-in-the-middle tamper with NTLM packets and modify flags without invalidating the signature. This matters because NTLM MIC is a defense against NTLM relay and downgrade attacks, so bypassing it reopens those paths on unpatched systems.
Impact
An attacker gains the ability to downgrade NTLM security features and relay or tamper with authentication traffic, with high integrity impact but no direct confidentiality or availability impact per the CVSS vector.
Attack surface
Reached over the network by a man-in-the-middle positioned between client and server; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), and the attacker must be able to tamper with the NTLM exchange.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is high at 0.48 (98.8th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the Microsoft security update that hardens NTLM MIC protection on the server side
- Enable and enforce SMB signing and LDAP signing/channel binding where supported
- Disable NTLM where feasible and prefer Kerberos authentication
- Restrict and monitor network paths that allow man-in-the-middle positioning between clients and servers
Detection
- Monitor for NTLM authentication failures and MIC-related errors in Windows security and SMB logs
- Alert on anomalous NTLM negotiation flags or downgrade patterns in authentication traffic
- Hunt for NTLM relay activity, including unexpected machine account authentication to sensitive services
- Track unpatched Windows hosts still exposing NTLM authentication
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-1040 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1040), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
