CVE-2011-1889
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft Forefront TMG Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 49% (percentile: 99) as of 1 November 2026
- CWE
- CWE-119
Affected products
microsoft: forefront threat management gateway
References
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-0… PatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-0… PatchVendor Advisory
- http://secunia.com/advisories/44857 Broken Link
- http://www.securityfocus.com/bid/48181 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1025637 Broken LinkThird Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67736 Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%… Broken Link
- http://secunia.com/advisories/44857 Broken Link
- http://www.securityfocus.com/bid/48181 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1025637 Broken LinkThird Party AdvisoryVDB Entry