Microsoft Forefront Threat Management Gateway vulnerabilities

3 CVEs affecting Microsoft Forefront Threat Management Gateway, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-1889, published 2011-06-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1889: Microsoft Forefront TMG Remote Code Execution Vulnerability, published 2011-06-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 49% chance of exploitation in the next 30 days. The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified…
CVE-2009-0077, published 2009-04-15. Medium severity, CVSS 5.0. EPSS: 78.5% chance of exploitation in the next 30 days. The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability…
CVE-2009-0237, published 2009-04-15. Medium severity, CVSS 4.3. EPSS: 22.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet…