Updated On: August 21, 2026

Understanding Common Vulnerabilities in Public-Facing Applications in 2026

Public-facing applications are important for delivering services to customers and supporting daily business operations. However, because these applications are accessible over the internet and often handle sensitive data, they remain a common target for cybercriminals. Since K logix first published Understanding Common Vulnerabilities in Public-Facing Applications in 2024, exploiting public-facing applications (MITRE T1190) has become an even more common way for threat actors to gain initial access to systems. IBM X-Force reported that exploitation of public-facing applications was the most common initial access vector in its 2026 Threat Intelligence Index.

K logix continues to observe cybercriminals exploiting cross-site scripting and SQL injection, two vulnerabilities covered in the original blog. This update now includes broken access control, which ranks as one of the top risks for public-facing applications.

Cross-Site Scripting (XSS)

XSS vulnerabilities occur when a web application accepts untrusted input or content and later displays it without properly sanitizing or encoding it. If that content includes malicious script, it may run in a user's browser and expose sensitive information.

A recent example is Operation RoundPress, a cyber-espionage campaign reported by ESET in 2025 that remains active in 2026. In this campaign, attackers abuse XSS vulnerabilities in webmail platforms by placing malicious script inside normal-looking emails. When a targeted user opens the email, the script runs in the browser and allows attackers to access webmail data, such as credentials and messages.

To mitigate XSS risks, organizations should use proper input validation, output encoding, and enforce a Content Security Policy (CSP) to control which scripts are allowed to run on a web page.

SQL Injection

SQL injection happens when an application does not properly separate user input from database queries. If attackers can insert their own commands into a request, they may be able to view, change, or delete data the application should protect.

In August 2026, Metabase disclosed a critical SQL injection vulnerability (CVE-2026-72898) that was being actively exploited. The vulnerability allowed a remote, unauthenticated attacker to submit malicious SQL through the password reset feature and gain administrator access to the affected Metabase instance. With administrator access, the attacker could modify the application and reach sensitive data.

Organizations can protect against SQL injection attacks by using prepared statements and parameterized queries. These controls separate user input from database commands which helps reduce the risk of unauthorized access, data manipulation, or data theft.

Broken Access Control

Broken access control is an addition to this update. OWASP ranks it as the top web application security risk, making it important to call out when discussing public-facing applications. Broken access control occurs when an application does not properly enforce what a user is allowed to see or do. A common example is an insecure direct object reference (IDOR), which is when an attacker changes an identifier in a request, such as a record number, to access another user's data.

In June 2025, researchers examining the McDonald's "McHire" recruiting platform found an abandoned test admin account with the password "123456". After gaining access, they found a broken access control flaw that allowed them to retrieve applicant records by changing the ID number in a request. The issue exposed names, contact details, and chat histories tied to about 64 million job applicants. In July 2026, CISA also added an IDOR vulnerability in the Langflow AI platform (CVE-2026-55255) to its Known Exploited Vulnerabilities catalog after reports of active exploitation.

To defend against broken access control, organizations should enforce server-side authorization checks. Access should be denied by default unless the user has permission to view or change the requested resource.

Conclusion

XSS, SQL injection, and broken access control vulnerabilities are not new, but attackers continue to use them because they work. Regular testing, timely patching, and strong access controls remain some of the best ways to protect public-facing applications.