Exploit Public-Facing Application

ID: T1190
Tactics: TA0001 Initial Access
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Data sources: Application Log Content, Process Creation, Module Load, Network Connection Creation, Network Traffic Content, Network Traffic Flow
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.^[2]^[3]^[4]^[5]^[6] On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.^[7]^[8] Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution.

If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.

Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.^[9]^[10]

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.^[1]^[11]

Detection

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
Data components: Application Log Content, Process Creation, Module Load, Network Connection Creation, Network Traffic Content, Network Traffic Flow

Mitigations (8)

M1016 Vulnerability Scanning: Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.^[1]
M1026 Privileged Account Management: Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
M1030 Network Segmentation: Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
M1035 Limit Access to Resource Over Network: Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
M1037 Filter Network Traffic: Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.
M1048 Application Isolation and Sandboxing: Application isolation will limit what other processes and system features the exploited target can access.
M1050 Exploit Protection: Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
M1051 Update Software: Update software regularly by employing patch management for externally exposed applications.

Exploit Public-Facing Application

Detection

Mitigations (8)

Groups (47)

Software (8)

References