Patch Forecast
Amber warning
Patch this week.

CVE-2026-104711

Apache Struts: expression language injection can lead to remote code execution

Risk score
77/100
CVSS
9.8 v3.1
Exploit chance (30 days)
1.2%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts…
Affected
Apache Struts before 6.12.0, 7.4.0
Fix
Upgrade Apache Struts to 6.12.0 or 7.4.0 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache StrutsTHE FLAWSTHE FIXCVE-2026-104711Expression language injectioncan lead to remote codeexecutionCVSS 9.8 · EPSS 1%CVE-2016-3081Apache Struts CommandInjection VulnerabilityCVSS 8.1 · EPSS 96% · exploitedCVE-2026-104714Race conditionCVSS 8.8 · EPSS 1%CVE-2026-104712Asymmetric resourceconsumption (amplification)vulnerability in Apache StrutsCVSS 7.5 · EPSS 1%Upgrade Apache Struts6.12.0 · 7.4.0or later on your release lineWho is exposed{'products': ['Apache Struts'],'packages': [], 'versions':['2.3.19', '2.3.20.2', '2.3.21','2.3.24.1', '2.3.25', '2.3.28']}RED · ACT TODAYApache StrutsApache Struts 2.3.19 to 2.3.28has a command injectionvulnerability when DynamicMethod Invocation is enabled,allowing remote attackers toexecute arbitrary code.Where it standsExploited in the wildOn CISA's exploited list since 8 OctUS federal deadline 11 OctHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.8 Oct · CISAAdded to the Known Exploited Vulnerabilities list11 Oct · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessExpression language injection (CWE-917)4 other warnings in 30 days →Same productEarlier Apache Struts warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Struts: Red, act today. Apache Struts 2.3.19 to 2.3.28 has a command injection vulnerability when Dynamic Method Invocation is enabled, allowing remote attackers to execute arbitrary code.

The flaws

  • CVE-2026-104711: Expression language injection can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (CVSS 8.1 · EPSS 96% · exploited)
  • CVE-2026-104714: Race condition (CVSS 8.8 · EPSS 1%)
  • CVE-2026-104712: Asymmetric resource consumption (amplification) vulnerability in Apache Struts (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Apache Struts: 6.12.0 · 7.4.0 or later on your release line

Who is exposed: {'products': ['Apache Struts'], 'packages': [], 'versions': ['2.3.19', '2.3.20.2', '2.3.21', '2.3.24.1', '2.3.25', '2.3.28']}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 8 Oct
  • US federal deadline 11 Oct

How it unfolded

  1. 8 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 11 Oct, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in

References

Original description

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Last activity 5 Oct 2026. Patch Forecast updates every hour.