Skip to main content
IMMUNITYSEC

CVE-2011-1889

9.8
CRITICAL
CVSS 3.1
EPSS 49.0% · 99th pctCISA KEV · Exploited in the wild
2011-06-16•Updated 2025-10-22•KEV 2022-03-03
CISA Known Exploited Vulnerabilities

Microsoft Forefront TMG Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2022-03-03
Remediation due
2022-03-24

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2011-1889

Description

The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."

Severity

CVSS 3.1 · CISA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
--
n/a

References

6 Links
Vendor advisories
Third-party advisories

Record Details

Published
2011-06-16
Last updated
2025-10-22
Assigner (CNA)
microsoft
Credited to
-

More from Microsoft

All Microsoft CVEs→
CVE-2015-16359.8 CRITICAL

Microsoft HTTP.sys Remote Code Execution Vulnerability

KEVEPSS 100.0%2015-04-14
CVE-2019-07089.8 CRITICAL

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

MicrosoftKEVEPSS 100.0%2019-05-16
CVE-2025-537709.8 CRITICAL

Microsoft SharePoint Server Remote Code Execution Vulnerability

MicrosoftKEVEPSS 100.0%2025-07-20
CVE-2021-344739.1 CRITICAL

Microsoft Exchange Server Remote Code Execution Vulnerability

MicrosoftKEVEPSS 100.0%2021-07-14

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.