T1556

Modify Authentication Process

6 CVEs mapped

TA0003PersistenceTA0006Credential Access

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Platforms8

IaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

CVEs mapped to this technique6

CVE	Description	Severity	EPSS	Flags	Modified
CVE-2026-87902	An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.	HIGH8.1	96%p100	KEVPoC	2026-09-28
CVE-2026-81578	An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.	CRITICAL9.8	84%p100	KEVWeaponized	2026-09-14
CVE-2026-82078	An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.	CRITICAL9.1	61%p99	KEVWeaponized	2026-09-14
CVE-2022-37055	D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,	CRITICAL9.8	56%p99	KEV	2026-06-17
CVE-2025-66376	Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.	MEDIUM6.1	20%p97	KEV	2026-10-07
CVE-2026-86218	N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.	CRITICAL9.8	15%p97	KEVWeaponized	2026-09-09