CVE-2011-1889
Microsoft Forefront TMG Remote Code Execution Vulnerability
Published Jun 16, 2011 · updated Jun 16, 2026 · microsoft forefront threat management gateway
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jun 16, 2011 · Catalog
Detected
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
Mar 3, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 24, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
Required action
Apply updates per vendor instructions.
CISA due date Mar 24, 2022
Affected
- cpe microsoft/forefront threat management gateway2010
- vendor Microsoft Forefront Threat Management Gateway (TMG)version unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2011-1889
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
cisa.gov - CVE.orgVulnerability recordCVE-2011-1889
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2011-1889
30-day exploitation probability 49.0%
first.org - NIST NVDVulnerability recordCVE-2011-1889
The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."
nvd.nist.gov