CVE-2019-1040 Vulnerability
Published:10/07/2025
Written by: Monica Burgess
CVE-2019-1040 is a critical tampering vulnerability found in Microsoft Windows New Technology LAN Manager (NTLM). This flaw allows a man-in-the-middle (MitM) attacker to bypass certain NTLM protections, like Message Integrity Code (MIC), and downgrade NTLM security features. This lets them relay an authentication request to a target server, like one running Exchange or ADFS, and gain access as the authenticated user. Essentially, it’s a way for attackers to slip past security checks and take control.
When was it Discovered?
The vulnerability was discovered and reported by security researchers Marina Krotofil and Yushkevich. Microsoft issued a patch for CVE-2019-1040 as part of its Patch Tuesday release on June 11, 2019. The public disclosure highlighted the significant risks associated with NTLM relay attacks, especially in complex enterprise environments where NTLM is still widely used for authentication.
Affected Products & Versions
This vulnerability impacts various Windows operating systems and services that rely on NTLM authentication. Proper patching is crucial to secure these products.
Product | Versions Affected | Fixed Versions / Patch Links |
Windows Server | 2008, 2012, 2016, 2019 | Apply the latest security updates from Microsoft. |
Windows Client | 7, 8.1, 10 | Apply the latest security updates from Microsoft. |
Exchange Server | All versions using NTLM | Apply the latest security updates and consider mitigations. |
CVE-2019-1040 Technical Description
So, how does this whole thing work? CVE-2019-1040 gets its power by exploiting a logic flaw in how NTLM authentication handles certain connection states. Normally, NTLM includes a Message Integrity Code (MIC) to prevent tampering. This MIC acts like a digital seal, ensuring the authentication messages haven't been messed with in transit.
The vulnerability lets an attacker intercept an authentication attempt and modify it to remove the MIC field from the NTLM AUTHENTICATE message. They can then relay this tampered message to a target server. The core issue is that the server, under specific conditions, fails to reject this message that's missing its integrity check. This allows the attacker to establish an authenticated session on behalf of the victim, effectively bypassing the primary defense against NTLM relay attacks.
Tactics, Techniques & Procedures (TTPs)
Attackers exploiting CVE-2019-1040 typically use a man-in-the-middle (MitM) position to intercept network traffic. Their TTPs often involve poisoning network name resolution protocols like LLMNR or NBNS to trick a victim's machine into sending authentication credentials to an attacker-controlled machine. Once they capture the NTLM hash, they use tools like ntlmrelayx to perform the relay attack, targeting high-value services like Exchange Web Services (EWS) to dump mailboxes or escalate privileges.
Indicators of Compromise
Detecting an active CVE-2019-1040 exploit means looking for weirdness in your network traffic. Key indicators of compromise (IOCs) include NTLM authentication traffic where the AUTHENTICATE message is missing the MIC field. You might also see an unusual volume of NTLM authentication attempts from unexpected sources or logon failures that point to relay attempts. Keep an eye on logs for suspicious sign-ins to services like Exchange or ADFS, especially if they originate from internal IP addresses that shouldn't be making those connections.
Known Proof-of-Concepts & Exploits
Shortly after its disclosure, proof-of-concept (PoC) exploits for CVE-2019-1040 became available. Security researchers demonstrated how to use modified versions of popular tools like Impacket's ntlmrelayx.py script to automate the attack. These PoCs showed that attackers could successfully relay authentication to services like Exchange and execute actions such as creating new inbox rules for persistence or exfiltrating sensitive data. These tools lowered the barrier to entry, making the CVE-2019-1040 exploit accessible to a wider range of threat actors.
How to Detect CVE-2019-1040 Vulnerability?
Detecting attempts to exploit CVE-2019-1040 requires a layered approach. On the network side, intrusion detection systems (IDS) can be configured with signatures to flag NTLM authentication packets that are missing the MIC. Host-based detection, using an Endpoint Detection and Response (EDR) solution, can monitor for suspicious logon events and process execution that might follow a successful relay attack. SIEM systems are also your friend here—correlate Windows security event logs (specifically Event ID 4624 for successful logons) with network traffic data to spot anomalies, like a user logging into a server from an unusual workstation.
Impact & Risk of CVE-2019-1040 Vulnerability
Let's be real, the impact of a successful CVE-2019-1040 exploit is no joke. An attacker can gain unauthorized access to sensitive systems with the same privileges as the compromised user. If they relay the credentials of a domain administrator, it's pretty much game over. They could access confidential data, manipulate system configurations, or deploy ransomware across the network. This directly threatens data confidentiality, integrity, and availability, leading to potential data breaches, financial loss, and serious reputational damage.
Mitigation & Remediation Strategies
First and foremost, patch your systems! Microsoft released a security update for CVE-2019-1040, and applying it is the most effective way to shut this down. Beyond patching, you should implement security best practices to harden your environment against relay attacks in general. This includes enabling EPA (Extended Protection for Authentication) and requiring SMB signing on all devices. Where possible, consider disabling NTLM altogether in favor of Kerberos. If you can't get rid of NTLM completely, use network segmentation to limit the exposure of critical servers.
CVE-2019-1040 Vulnerability FAQs
Protect What Matters
