EXPOSURES › CVE-2011-1889
CVE-2011-1889
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in Microsoft Forefront TMG's Winsock provider allowed attackers to execute code in the client application's security context.
This vulnerability enabled remote code execution in the context of the client application, posing a severe risk to systems relying on Forefront TMG. DIB organizations must ensure all Microsoft products are patched against known CVEs, as unpatched vulnerabilities can lead to significant security breaches and compliance failures.
Shame score — The vulnerability was actively exploited in the wild (KEV status) and allowed remote code execution, indicating a significant failure in Microsoft's patch management and security practices.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
"A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application."
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |