Servers and applications
CVE-2016-3082 XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
Severity Critical 9.8
Published 26 Apr 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 19% in the next 30 daysHigher than 97% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Read data · Change data · Take it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources NVD Affected software Software Affected versions Apache StrutsServers and applications · cpe:a:apache:struts Version 2.3.28 Version 2.3.24.1 Version 2.3.24 Version 2.3.20.1 All 56 release lines Version 2.0.0 Version 2.0.1 Version 2.0.2 Version 2.0.3 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.0.11.1 Version 2.0.11.2 Version 2.0.12 Version 2.0.13 Version 2.0.14 Version 2.1.0 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.1.4 Version 2.1.5 Version 2.1.6 Version 2.1.8 Version 2.1.8.1 Version 2.2.1 Version 2.2.1.1 Version 2.2.3 Version 2.2.3.1 Version 2.3.1 Version 2.3.1.1 Version 2.3.1.2 Version 2.3.3 Version 2.3.4 Version 2.3.4.1 Version 2.3.7 Version 2.3.8 Version 2.3.12 Version 2.3.14 Version 2.3.14.1 Version 2.3.14.2 Version 2.3.14.3 Version 2.3.15 Version 2.3.15.1 Version 2.3.15.2 Version 2.3.15.3 Version 2.3.16 Version 2.3.16.1 Version 2.3.16.2 Version 2.3.16.3 Version 2.3.20 Version 2.3.20.1 Version 2.3.24 Version 2.3.24.1 Version 2.3.28
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3082 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3082