CVE-2011-1889
KEVMicrosoft Forefront TMG Remote Code Execution Vulnerability
Description
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedJun 16, 2011
Last modifiedJun 16, 2026
Added to KEVMar 3, 2022
Remediation dueMar 24, 2022
References
- secunia.com/advisories/44857Broken Link
- securityfocus.com/bid/48181Broken LinkThird Party Advisory
- securitytracker.com/id?1025637Broken LinkThird Party Advisory
- docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-040PatchVendor Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/67736Third Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12642Broken Link
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-1889US Government Resource
0 recent articles mention this CVE
84
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1678 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 49.0% · top 1% of all CVEs
- Weakness
- CWE-119
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.