Zero Radar
← feed
CriticalVulnerabilityCVE-2016-3081updated 25 Oct 2026, 17:35 UTC

Apache Struts web framework can let attackers run code on the server

Attackers on the internet can send a specially crafted web request and make the server run commands they choose. This can give them full control of the affected website or application.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.1 of 10
Being exploited?YesConfirmed by CISA KEV · 8 Oct 2026,
Fix available?Yes2.3.20.3, 2.3.24.3, and 2.3.28.1 (one fixed release per affected branch) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request with method: prefix
  2. 2Request reaches siteInternet-facing Struts application
  3. 3Expression evaluatedDynamic Method Invocation processes chained expression
  4. 4Code executesAttacker-chosen commands run on server
  5. ResultAttacker controls the server

What happened

Apache Struts 2 versions 2.3.19 through 2.3.28 (in several version ranges) allow remote code execution via a 'method:' prefix in chained expressions when Dynamic Method Invocation is enabled.

Why it is dangerous: Successful exploitation lets an attacker execute arbitrary code on the server, which can lead to data theft, tampering, or further intrusion into the network. Any internet-facing Struts application with the affected settings is at risk.

Are you affected?

You are affected if your application uses one of the vulnerable struts2-core versions (2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.2, or 2.3.25 to 2.3.28) and Dynamic Method Invocation is enabled.

Package / productAffected versionsFixed in
org.apache.struts:struts2-core · maven>= 2.3.19, <= 2.3.20.22.3.20.3
org.apache.struts:struts2-core · maven>= 2.3.25, <= 2.3.282.3.28.1
org.apache.struts:struts2-core · maven>= 2.3.21, <= 2.3.24.22.3.24.3

What to do

  1. Upgrade struts2-core to 2.3.20.3, 2.3.24.3, or 2.3.28.1, matching your current branch.
  2. If you cannot upgrade immediately, disable Dynamic Method Invocation as a mitigation per vendor instructions.
  3. Check whether internet-facing systems were exposed and review logs for suspicious requests using the 'method:' prefix.
  4. Follow CISA's BOD 26-04 guidance and forensics triage requirements if compromise is suspected.

Timeline

  1. 14 May 2022, 00:54 UTC
    Publicly disclosed
  2. 8 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fixed version published: org.apache.struts:struts2-core 2.3.20.3, org.apache.struts:struts2-core 2.3.28.1, org.apache.struts:struts2-core 2.3.24.3 · GitHub Advisory
  5. 25 Oct 2026, 17:35 UTC
    Fix: 2.3.20.3, 2.3.24.3, and 2.3.28.1 (one fixed release per affected branch)

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2016-3081 · GHSA-8c6j-ffmf-q6vm
CVSS
8.1 / 10
EPSS
97% chance of exploitation within 30 days
Disclosed
14 May 2022, 00:54 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Struts web framework can let attackers run code on the server · Zero Radar