CAPEC-176
Configuration/Environment Manipulation
An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-176: Configuration/Environment Manipulation: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/176.html and https://cve.bz/cve/capec/176?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target application must consult external files or configuration controls to control its execution. All but the very simplest applications meet this requirement.
Resources required
The attacker must have the access necessary to affect the files or other environment items the targeted application uses for its operations.
Weaknesses it exploits
- CWE-15 External Control of System or Configuration Setting
- CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
- CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks
- CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
- CWE-1328 Security Version Number Mutable to Older Versions
Recent CVEs with these weaknesses
- 7.8CVE-2026-104619
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
- 8.8CVE-2026-13292
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by inject…
- 7.1CVE-2026-121614
Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a d…
- 8.7CVE-2026-121427
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shou…
- 4.6CVE-2025-68403
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have a…
- 7.7CVE-2026-110845
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authen…
- 5.5CVE-2026-96218
Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
- 7.3CVE-2026-96188
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
MITRE's words, unchanged: CAPEC-176 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.