CAPEC-88

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Identify inputs for OS commands] The attacker determines user controllable input that gets passed as part of a command to the underlying operating system.

      3 techniques

      • Port mapping. Identify ports that the system is listening on, and attempt to identify inputs and protocol types on those ports.
      • TCP/IP Fingerprinting. The attacker uses various software to make connections or partial connections and observe idiosyncratic responses from the operating system. Using those responses, they attempt to guess the actual operating system.
      • Induce errors to find informative error messages

   2. [Survey the Application] The attacker surveys the target application, possibly as a valid and authenticated user

      2 techniques

      • Spidering web sites for all available links
      • Inventory all application inputs

2. Experiment

   They probe what they found.

   3. [Vary inputs, looking for malicious results.] Depending on whether the application being exploited is a remote or local one the attacker crafts the appropriate malicious input, containing OS commands, to be passed to the application

      2 techniques

      • Inject command delimiters using network packet injection tools (netcat, nemesis, etc.)
      • Inject command delimiters using web test frameworks (proxies, TamperData, custom programs, etc.)

3. Exploit

   They carry out the attack.

   4. [Execute malicious commands] The attacker may steal information, install a back door access mechanism, elevate privileges or compromise the system in some other way.

      1 technique

      • The attacker executes a command that stores sensitive information into a location where they can retrieve it later (perhaps using a different command injection).

Prerequisites

• User controllable input used as part of commands to the underlying operating system.

Skills required

• High skill

  The attacker needs to have knowledge of not only the application to exploit but also the exact nature of commands that pertain to the target operating system. This may involve, though not always, knowledge of specific assembly commands for the platform.

Consequences

Mitigations

• Use language APIs rather than relying on passing data to the operating system shell or command line. Doing so ensures that the available protection mechanisms in the language are intact and applicable.

• Filter all incoming data to escape or remove characters or strings that can be potentially misinterpreted as operating system or shell commands

• All application processes should be run with the minimal privileges required. Also, processes must shed privileges as soon as they no longer require them.

Weaknesses it exploits

• CWE-20 Improper Input Validation
• CWE-78 Improper Neutralization of Special Elements used in an OS Command
• CWE-88 Improper Neutralization of Argument Delimiters in a Command
• CWE-697 Incorrect Comparison

Recent CVEs with these weaknesses

1. 4.9CVE-2026-1074042026-11-10

   Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

2. 4.9CVE-2026-1054272026-11-10

   Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

3. 6.7CVE-2026-1054262026-11-10

   Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

4. 6.7CVE-2026-1056692026-11-10

   Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.

5. 7.2CVE-2026-1054252026-11-10

   OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code…

6. 9.6CVE-2026-1081862026-11-10

   Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

7. 6.3CVE-2026-1258712026-11-10

   The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…

8. 8.8CVE-2026-1237172026-11-10

   OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the op…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-248 Command Injection

Examples

MITRE's words, unchanged: CAPEC-88 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.