Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
High 8.1Actively exploitedPatch available
CVE-2016-3081
Apache Struts — Command Injection.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Published Updated Source NVD and CISA KEV
CVSS 3.1
8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
97%
Higher than 99% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 8 Oct 2026
Patch
Available
See the vendor advisory
What happened
What to do
- 01Check whether you run Apache Struts, and which version.
- 02Install the fixed version listed in the vendor advisory.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
- NVDnvd.nist.gov
- CISA KEVcisa.gov
- Patchoracle.com
- Patchstruts.apache.org
- Third-party advisoryhuawei.com
- Third-party advisoryoracle.com
- Third-party advisoryrapid7.com
- Third-party advisoryrapid7.com
- Third-party advisorysecurityfocus.com
- Third-party advisorysecurityfocus.com
- Third-party advisorysecuritytracker.com
- Exploitpacketstormsecurity.com
Timeline · UTC
- Published to NVD
- Added to CISA KEV
- NVD record updated
- CISA remediation deadline
Also actively exploited
Other CVEs in Apache Struts
1 more CVE