---
id: "CVE-2011-1889"
kind: "vulnerability"
aliases: ["CVE-2011-1889"]
title: "Microsoft Forefront Threat Management Gateway (TMG): Microsoft Forefront TMG Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.4902
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Forefront Threat Management Gateway (TMG)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall-client", "forefront-tmg", "infrastructure", "windows"]
not_affected_if: ["firewall-client-not-deployed", "tmg-not-installed"]
published_at: "2011-06-16T20:55:02+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1889", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2011-1889", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1889", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Forefront Threat Management Gateway (TMG): Microsoft Forefront TMG Remote Code Execution Vulnerability

Microsoft Forefront Threat Management Gateway (TMG) has a remote code execution flaw in its Firewall Client Winsock provider. An attacker can run code in the security context of the client application that uses it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Forefront Threat Management Gateway (TMG) affected ? fixed ?

## Fix

Apply the Microsoft updates for Forefront TMG per vendor instructions, as CISA requires; the specific patch name is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1889
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2011-1889
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2011-1889

## From the sources

A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_