CVE-2016-3081 Exploited in the wild
Apache Struts Command Injection Vulnerability
- Risk score
- 100/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 96.1%
- Published
- 26 Apr 2016
- Added to CISA's exploited list
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache Struts 2.3.19 to 2.3.28 has a command injection vulnerability when Dynamic Method Invocation is enabled, allowing remote attackers to execute arbitrary code.
- Affected
- {'products': ['Apache Struts'], 'packages': [], 'versions': ['2.3.19', '2.3.20.2', '2.3.21', '2.3.24.1', '2.3.25', '2.3.28']}
- Fix
- Apply mitigations in accordance with vendor instructions
- Exploitation
- Exploited in the wild
Story map
At a glance
Apache Struts: Red, act today. Apache Struts 2.3.19 to 2.3.28 has a command injection vulnerability when Dynamic Method Invocation is enabled, allowing remote attackers to execute arbitrary code.
The flaws
- CVE-2016-3081: Apache Struts Command Injection Vulnerability (CVSS 8.1 · EPSS 96% · exploited)
- CVE-2026-104711: Expression language injection can lead to remote code execution (CVSS 9.8 · EPSS 1%)
- CVE-2026-104714: Race condition (CVSS 8.8 · EPSS 1%)
- CVE-2026-104712: Asymmetric resource consumption (amplification) vulnerability in Apache Struts (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Apache Struts: 6.12.0 · 7.4.0 or later on your release line
Who is exposed: {'products': ['Apache Struts'], 'packages': [], 'versions': ['2.3.19', '2.3.20.2', '2.3.21', '2.3.24.1', '2.3.25', '2.3.28']}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 8 Oct
- US federal deadline 11 Oct
How it unfolded
- 8 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
- 11 Oct, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: Command injection (CWE-77). 97 other warnings in 30 days
- Same product: Earlier Apache Struts warnings. 1 in the last 90 days
Why it is Red
- CVSS 8.1 high
- Exploitation likely: EPSS 96.1% (top 1%)
- Exploited in the wild (CISA KEV)
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
- http://www.securityfocus.com/bid/87327
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1035665
- https://struts.apache.org/docs/s2-032.html
Original description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Last activity 8 Oct 2026. Patch Forecast updates every hour.