[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1190":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1190","T1190","Exploit Public-Facing Application",106,"MITRE","**What attackers do.** Attackers exploit a weakness in an internet-facing system, such as a web application, VPN appliance, firewall, mail server or database, to get a foothold inside the network. This serves Initial Access and often leads quickly to web shells or credential theft.\n\n**How to defend.** Keep an accurate inventory of everything exposed to the internet and patch it fast, prioritising vulnerabilities known to be exploited in the wild. Put a web application firewall in front of custom applications, reduce exposed management interfaces, and segment edge systems so a compromise does not reach the core network. Collect web server, application and appliance logs centrally, since many edge devices cannot run endpoint agents.\n\n**Signs to look for.** Look for unusual requests or error spikes in web logs, new files in web directories, and server processes spawning shells or making outbound connections. A frequent gap is edge appliances with little logging and no endpoint visibility.","Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites\u002Fweb servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution.\n\nIf an application is hosted on cloud-based infrastructure and\u002For is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1190\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"chinese-espionage-group-exploits-beyondtrust-zero-day-in-remote-support-tool","Chinese Espionage Group Exploits BeyondTrust Zero-Day in Remote Support Tool","2026-10-16T18:20:52.789+00:00",{"slug":25,"title":26,"published_at":27},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":29,"title":30,"published_at":31},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","2026-10-16T08:21:33.492+00:00",{"slug":33,"title":34,"published_at":35},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","2026-10-16T08:20:44.884+00:00",{"slug":37,"title":38,"published_at":39},"ivanti-zero-day-grants-root-access-to-fully-patched-vpn-appliances","Ivanti Zero-Day Grants Root Access to Fully Patched VPN Appliances","2026-10-13T20:21:02.111+00:00",{"slug":41,"title":42,"published_at":43},"anydesk-linux-root-exploit-highlights-silent-patching-dangers","AnyDesk Linux Root Exploit Highlights Silent Patching Dangers","2026-10-09T16:21:13.394+00:00",{"slug":45,"title":46,"published_at":47},"unpatched-ahsaycbs-backup-flaws-actively-exploited-for-remote-code-execution","Unpatched AhsayCBS Backup Flaws Actively Exploited for Remote Code Execution","2026-10-09T12:22:15.804+00:00",{"slug":49,"title":50,"published_at":51},"hafnium-exchange-attacks-highlight-critical-patching-failures","Hafnium Exchange Attacks Highlight Critical Patching Failures","2026-10-08T14:21:11.97+00:00",{"slug":53,"title":54,"published_at":55},"clingstun-linux-backdoor-exploits-dozens-of-flaws-via-stealthy-stun-protocol","ClingSTUN Linux Backdoor Exploits Dozens of Flaws via Stealthy STUN Protocol","2026-10-05T14:20:55.456+00:00",{"slug":57,"title":58,"published_at":59},"zero-day-strikes-citrix-netscaler-appliances-days-after-prior-patches","Zero-Day Strikes Citrix NetScaler Appliances Days After Prior Patches","2026-10-05T06:20:22.634+00:00",{"slug":61,"title":62,"published_at":63},"divd-breached-via-zammad-zero-day-exploits-attacker-gains-root-access","DIVD Breached via Zammad Zero-Day Exploits, Attacker Gains Root Access","2026-10-03T12:20:25.728+00:00",{"slug":65,"title":66,"published_at":67},"warlock-group-exploits-unpatched-sharepoint-to-hit-critical-infrastructure","Warlock Group Exploits Unpatched SharePoint to Hit Critical Infrastructure","2026-10-02T10:20:36.512+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",68,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",67,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",65,{"slug":85,"name":86,"problem":87,"stories":88},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",16,{"slug":90,"name":91,"problem":92,"stories":93},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",15,{"slug":95,"name":96,"problem":97,"stories":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",13,[100,106,111,117,121,126,131,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",104,{"family":101,"item":107,"code":108,"title":109,"together":110},"12","Control 12","Network Infrastructure Management",93,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-800-53","si-2","SI-2","Flaw Remediation",84,{"family":101,"item":118,"code":119,"title":120,"together":83},"13","Control 13","Network Monitoring and Defense",{"family":112,"item":122,"code":123,"title":124,"together":125},"sc-7","SC-7","Boundary Protection",64,{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",57,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",54,{"family":112,"item":138,"code":139,"title":140,"together":141},"ir-4","IR-4","Incident Handling",35]