Apache · Struts
CVE-2016-3081
Apache Struts Command Injection Vulnerability
What it is
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CISA: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Deadline for US federal agencies: October 11, 2026
- Added to the CISA list
- October 8, 2026
- Published
- April 26, 2016
- Severity
- High 8.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 97% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-77
- More details
- NVD · CVE.org · CISA
All references (11)
- http://www.securitytracker.com/id/1035665
- https://struts.apache.org/docs/s2-032.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
- https://www.exploit-db.com/exploits/39756/
- http://www.securityfocus.com/bid/91787
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execut…
- http://www.securityfocus.com/bid/87327
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Improper Input Validation | Struts | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Deserialization of Untrusted Data | Struts | High 8.1 | 99.4% |
| Nov 3, 2021 | Remote Code Execution | Struts | High 8.1 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | 96% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.