T1190

Official Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.(Citation: Recorded Future ESXiArgs Ransomware 2023)(Citation: Ars Technica VMWare Code Execution Vulnerability 2021) Depending on the flaw being exploited, this may also involve [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).

If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005)), exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.

Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)

Tactics: Initial Access
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
MITRE Version: 2.8
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (1055)

Microsoft reports that Storm-3358 exploited security flaws in web applications, including anonymous file upload and SSRF. Microsoft Reports Storm-3358 Using ARTEX to Target Financial Organizations
The described attack exploits a vulnerable WordPress installer reachable through the web during a core update. WordPress Fix Can Leave a Brief Exploitation Window During Installation
The flaw allows an attacker who can reach an SSH server to bypass authentication and access certain accounts. OpenSSH Patches SSHole Authentication Bypass Affecting Some Linux Configurations
An unauthenticated remote attacker can exploit the authentication bypass through a reachable, vulnerable SSH service. OpenSSH Password-Authentication Bypass Affects Certain musl-Based Linux Systems
The article says attackers exploited an application vulnerability in DreamHost’s web-based file manager to infiltrate host server processes. DreamHost Reports Intrusion Exposing FTP, SFTP and Webmail Credentials

CVE (843)

Malware (633)

People (482)

Threat Actors (605)

MITRE ATT&CK (379)

Vendors (478)

Products (1576)

Tools (871)

Industries (307)

Countries (126)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.