vulnwire
8.1high

CVE-2016-3081KEVin critical feed2 exploitsNuclei template

Apache Struts RCE Vulnerability

Also known as GHSA-8c6j-ffmf-q6vm

Published 10 y ago · modified 28 d ago · JSON

CVSS
8.1
v3.1 · CNA
CISA KEV
Yes
added 2026-10-08
EPSS
96.5%
percentile 100%
Public exploits
2
Metasploit · Exploit-DB · Nuclei check

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Known exploited (CISA KEV)

Added
30 d ago
Due date
2026-10-11 (27 d ago)
Ransomware use
Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor / product
Apache / Struts
CISA name
Apache Struts Command Injection Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
30 d ago

Exploit prediction (EPSS)

96.53% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template Apache S2-032 Struts - Remote Code Execution · nuclei detection template
  • Metasploit exploit/multi/http/struts_dmi_exec Apache Struts Dynamic Method Invocation Remote Code Execution · metasploit exploit, excellent rank · 2016-04-27
  • EDB-39756 Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit) · remote · 2016-05-02

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C
GitHub3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.struts:struts2-core
>=2.3.19, <2.3.20.3
>=2.3.21, <2.3.24.3
>=2.3.25, <2.3.28.1
2.3.20.3
2.3.24.3
2.3.28.1

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

  • securitytracker.com /id/1035665 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • struts.apache.org /docs/s2-032.html · x_refsource_CONFIRM, x_transferred
  • huawei.com /en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2016-2881720.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2016-2881722.html · x_refsource_CONFIRM, x_transferred
  • rapid7.com /db/modules/exploit/linux/http/struts_dmi_exec · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/39756/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/91787 · vdb-entry, x_refsource_BID, x_transferred
  • packetstormsecurity.com /files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/87327 · vdb-entry, x_refsource_BID, x_transferred
  • rapid7.com /db/modules/exploit/multi/http/struts_dmi_exec · x_refsource_MISC, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2016-3081 · advisory
  • github.com /apache/struts · package
  • web.archive.org /web/20210123152457/http://www.securityfocus.com/bid/91787 · web
  • web.archive.org /web/20210225192113/http://www.securityfocus.com/bid/87327 · web
  • web.archive.org /web/20210226011418/http://www.securitytracker.com/id/1035665 · web
  • exploit-db.com /exploits/39756 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.