Servers and applications
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 8 Oct 2026.
- Severity
- High 8.1
- Published
- 26 Apr 2016
- Last changed
- 9 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.3.20.3, 2.3.24.3, 2.3.28.1
- Exploit chance
- 97% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Command injection (CWE-77)
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache StrutsServers and applications · cpe:a:apache:struts |
|
Known exploited
- CISA name
- Apache Struts Command Injection Vulnerability
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
- Due for US agencies
- 11 Oct 2026
- Used in ransomware
- Not known