CAPEC-216
Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-216: Communication Channel Manipulation: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/216.html and https://cve.bz/cve/capec/216?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target application must leverage an open communications channel.
The channel on which the target communicates must be vulnerable to interception (e.g., adversary in the middle attack - CAPEC-94).
Resources required
A tool that is capable of viewing network traffic and generating custom inputs to be used in the attack.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data, Modify Data, Other | Integrity | The adversary's injection of additional content into a communication channel negatively impacts the integrity of that channel. |
| Read Data | Confidentiality | A successful Communication Channel Manipulation attack can result in sensitive information exposure to the adversary, thereby compromising the communication channel's confidentiality. |
Mitigations
Encrypt all sensitive communications using properly-configured cryptography.
Design the communication system such that it associates proper authentication/authorization with each channel/message.
Weaknesses it exploits
- CWE-306 Missing Authentication for Critical Functionality
Recent CVEs with these weaknesses
- –CVE-2026-97870
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without creden…
- –CVE-2026-97872
When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the expose…
- 9.4CVE-2026-121683
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- –CVE-2026-111251
The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enable…
- –CVE-2026-111256
When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticate…
- –CVE-2026-87756
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint cou…
- –CVE-2026-111263
Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operati…
- 7.5CVE-2026-95651
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Can lead to
- CAPEC-94 Adversary in the Middle (AiTM)
MITRE's words, unchanged: CAPEC-216 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.