[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1190":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1190","T1190","Exploit Public-Facing Application",106,"MITRE","**What attackers do.** Attackers exploit a weakness in an internet-facing system, such as a web application, VPN appliance, firewall, mail server or database, to get a foothold inside the network. This serves Initial Access and often leads quickly to web shells or credential theft.\n\n**How to defend.** Keep an accurate inventory of everything exposed to the internet and patch it fast, prioritising vulnerabilities known to be exploited in the wild. Put a web application firewall in front of custom applications, reduce exposed management interfaces, and segment edge systems so a compromise does not reach the core network. Collect web server, application and appliance logs centrally, since many edge devices cannot run endpoint agents.\n\n**Signs to look for.** Look for unusual requests or error spikes in web logs, new files in web directories, and server processes spawning shells or making outbound connections. A frequent gap is edge appliances with little logging and no endpoint visibility.","Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites\u002Fweb servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution.\n\nIf an application is hosted on cloud-based infrastructure and\u002For is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1190\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},118,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"zero-day-in-n-central-exploited-within-hours-of-poc-release","Zero-Day in N-central Exploited Within Hours of PoC Release","2026-11-13T08:21:00.104+00:00",{"slug":26,"title":27,"published_at":28},"critical-apache-http2-race-condition-enables-unauthenticated-remote-code-execution","Critical Apache HTTP\u002F2 Race Condition Enables Unauthenticated Remote Code Execution","2026-11-12T21:20:53.405+00:00",{"slug":30,"title":31,"published_at":32},"zero-day-in-n-able-n-central-exploited-within-hours-of-poc-release","Zero-Day in N-able N-central Exploited Within Hours of PoC Release","2026-11-12T20:20:21.277+00:00",{"slug":34,"title":35,"published_at":36},"unpatched-check-point-gateways-used-as-pivot-point-for-wiper-deployment","Unpatched Check Point Gateways Used as Pivot Point for Wiper Deployment","2026-11-12T14:20:40.75+00:00",{"slug":38,"title":39,"published_at":40},"authentication-bypass-in-screenconnect-rmm-extension-enables-mass-endpoint-compromise","Authentication Bypass in ScreenConnect RMM Extension Enables Mass Endpoint Compromise","2026-11-12T11:20:19.724+00:00",{"slug":42,"title":43,"published_at":44},"unpatched-cisco-broadworks-flaw-actively-exploited-to-expose-sensitive-config-data","Unpatched Cisco BroadWorks Flaw Actively Exploited to Expose Sensitive Config Data","2026-11-11T11:21:54.919+00:00",{"slug":46,"title":47,"published_at":48},"unpatched-openwave-and-cisco-broadworks-flaws-actively-exploited-in-targeted-campaigns","Unpatched Openwave and Cisco BroadWorks Flaws Actively Exploited in Targeted Campaigns","2026-11-11T10:21:42.735+00:00",{"slug":50,"title":51,"published_at":52},"chained-barracuda-flaws-exploited-in-the-wild-before-widespread-patching","Chained Barracuda Flaws Exploited in the Wild Before Widespread Patching","2026-11-11T08:20:26.939+00:00",{"slug":54,"title":55,"published_at":56},"n-central-zero-days-unauthenticated-rce-highlights-patch-urgency-for-rmm-platforms","N-central Zero-Days: Unauthenticated RCE Highlights Patch Urgency for RMM Platforms","2026-11-11T07:20:40.952+00:00",{"slug":58,"title":59,"published_at":60},"exposed-pan-os-management-interfaces-exploited-via-critical-php2shell-flaws","Exposed PAN-OS Management Interfaces Exploited via Critical PHP2Shell Flaws","2026-10-30T11:20:26.03+00:00",{"slug":62,"title":63,"published_at":64},"unpatched-cisco-sd-wan-flaw-enables-state-sponsored-keydrift-malware-campaign","Unpatched Cisco SD-WAN Flaw Enables State-Sponsored KeyDrift Malware Campaign","2026-10-29T19:20:28.899+00:00",{"slug":66,"title":67,"published_at":68},"php2shell-critical-php-vulnerabilities-exploited-in-the-wild","PHP2Shell: Critical PHP Vulnerabilities Exploited in the Wild","2026-10-21T20:20:27.498+00:00",[70,75,80,85,90,94],{"slug":71,"name":72,"problem":73,"stories":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",78,{"slug":76,"name":77,"problem":78,"stories":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",75,{"slug":81,"name":82,"problem":83,"stories":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",73,{"slug":86,"name":87,"problem":88,"stories":89},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",16,{"slug":91,"name":92,"problem":93,"stories":89},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":95,"name":96,"problem":97,"stories":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",14,[100,106,111,117,122,126,131,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",116,{"family":101,"item":107,"code":108,"title":109,"together":110},"12","Control 12","Network Infrastructure Management",97,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-800-53","si-2","SI-2","Flaw Remediation",95,{"family":112,"item":118,"code":119,"title":120,"together":121},"sc-7","SC-7","Boundary Protection",65,{"family":101,"item":123,"code":124,"title":125,"together":121},"13","Control 13","Network Monitoring and Defense",{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",57,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",54,{"family":112,"item":138,"code":139,"title":140,"together":141},"ir-4","IR-4","Incident Handling",35]