CVE-2019-1166: Windows NTLM MIC protection bypass allows authentication tampering

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityHigh integrity impact and very high EPSS, but exploitation requires a man-in-the-middle position and no KEV listing or public exploit is recorded.

What it is

A tampering flaw in Microsoft Windows lets a man-in-the-middle attacker bypass NTLM Message Integrity Check protection. Because MIC is meant to stop modification of NTLM authentication traffic, bypassing it undermines the integrity guarantee of that exchange. The record does not name specific affected builds beyond the listed Windows versions.

Impact

An attacker positioned on the network path can alter NTLM authentication messages without detection, enabling tampering with the authentication exchange. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reached over the network by a man-in-the-middle positioned between client and server; the vector indicates no privileges and no user interaction required, though attack complexity is high.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged; EPSS is high at roughly 0.68 probability (99th percentile), suggesting elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the Microsoft security update for CVE-2019-1166 on all listed Windows versions.
• Enforce SMB signing and require NTLMv2 with extended protection where feasible.
• Reduce NTLM reliance in favor of Kerberos and restrict NTLM traffic via policy.
• Segment networks and use encrypted channels to limit man-in-the-middle positioning.

Detection

• Monitor for anomalous NTLM authentication failures or MIC-related errors in Windows security logs.
• Baseline and alert on unexpected NTLM authentication between hosts that normally use Kerberos.
• Watch for ARP spoofing, LLMNR/NBT-NS poisoning, or other MITM indicators on internal segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.