UpHeron
All vulnerabilities

Servers and applications

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by…

Severity
Critical 9.8
Published
5 Oct 2026
Last changed
8 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.12.0, 7.4.0
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • From 2.0.0 up to 2.3.37
  • From 2.5.0 up to 2.5.33
  • From 6.0.0 before 6.12.0
  • From 7.0.0 before 7.4.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-104711
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-104711