{"id":"CVE-2011-1889","kind":"vulnerability","aliases":["CVE-2011-1889"],"related":[],"title":"Microsoft Forefront Threat Management Gateway (TMG): Microsoft Forefront TMG Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Forefront Threat Management Gateway (TMG) has a remote code execution flaw in its Firewall Client Winsock provider. An attacker can run code in the security context of the client application that uses it.","severity":"critical","cvss":10.0,"epss":0.4902,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Microsoft Forefront Threat Management Gateway (TMG)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall-client","forefront-tmg","infrastructure","windows"],"not_affected_if":["firewall-client-not-deployed","tmg-not-installed"],"how_to_check":null,"fix":"Apply the Microsoft updates for Forefront TMG per vendor instructions, as CISA requires; the specific patch name is unknown from the sources.","status":"open","published_at":"2011-06-16T20:55:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:05+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:26:05Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Forefront TMG per vendor instructions, as CISA requires; the specific patch name is unknown from the sources.","reach":"unknown","impact":"high","summary":"Microsoft Forefront Threat Management Gateway (TMG) has a remote code execution flaw in its Firewall Client Winsock provider. An attacker can run code in the security context of the client application that uses it.","category":"infrastructure","who_cares":["forefront-tmg","windows","firewall-client"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code in the security context of the client application.","analyst_note":"Confirm affected TMG versions, the patch bulletin ID, and how to detect Firewall Client installs, via the Microsoft security advisory for CVE-2011-1889.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["tmg-not-installed","firewall-client-not-deployed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2872,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1889':16A,19A '-2011':15A,18A 'action':100C 'allow':87C 'appli':101C 'applic':65B,97C 'attack':54B 'cisa':98C 'client':29B,50B,64B,82C,96C 'code':11A,44B,57B,70C,88C 'context':61B,93C 'could':86C 'cve':14A,17A 'execut':12A,45B,71C,89C 'exist':73C 'exploit':26B 'firewal':28B,49B,81C 'firewall-cli':27B 'flaw':46B 'forefront':2A,8A,21A,31B,36B,76C 'forefront-tmg':30B 'gateway':5A,24A,39B,79C 'infrastructur':33B 'instruct':105C 'manag':4A,38B,78C 'management':23A 'microsoft':1A,7A,20A,35B 'per':103C 'provid':52B,84C 'remot':10A,43B,69C 'requir':99C 'run':56B 'secur':60B,92C 'threat':3A,22A,37B,77C 'tmg':6A,9A,25A,32B,40B,80C 'updat':102C 'use':67B 'vendor':104C 'vulner':13A,72C 'window':34B 'winsock':51B,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2011-06-16T20:55:02+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2011-1889","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1889","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2011-1889","url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1889","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2011-1889","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1889","severity":null,"published_at":"2011-06-16T20:55:02+00:00","modified_at":"2026-06-16T23:30:18+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}