Zero Radar
← feed
CriticalVulnerabilityupdated 2 Nov 2026, 06:31 UTC

Apache Struts2 lets attackers run code on the server

Struts is a tool many websites use to build their pages. A flaw can let an attacker send a specially crafted request that makes the server run commands they choose.

New1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker sends crafted requestRequest contains a malicious OGNL expression
  2. 2Sandbox check passesAllowed method accepts nested arguments
  3. 3Reflection runs uncheckedReflection call executes outside the sandbox
  4. 4Code runs on serverAttacker-chosen code executes server-side
  5. ResultAttacker controls the server

What happened

Apache Struts2 Core 7.4.0 and below has an OGNL sandbox escape: an allowed method that accepts nested arguments and invokes reflection internally runs outside the sandbox's restrictions, enabling arbitrary code execution.

Why it is dangerous: An attacker who can reach a vulnerable application could run code on its server, potentially taking control of the server and the data it holds. Any organization running affected Struts2 applications is at risk.

Are you affected?

You are affected if you run Apache Struts2 Core version 7.4.0 or below in a web application that processes OGNL expressions.

Apache Struts2 Core 7.4.0 and below

What to do

  1. Check whether your applications use Apache Struts2 Core 7.4.0 or below
  2. Watch Apache Struts security advisories for a fixed version and update as soon as one is released
  3. Limit network access to affected Struts2 applications until a fix is confirmed

Timeline

  1. 2 Nov 2026, 06:10 UTC
    Publicly disclosed
  2. 2 Nov 2026, 06:10 UTC
    Reported by Full Disclosure · Full Disclosure
  3. 2 Nov 2026, 06:31 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Technical details

ID
ZR-6d08cb75
Disclosed
2 Nov 2026, 06:10 UTC
On Zero Radar
2 Nov 2026, 06:31 UTC (20 min after disclosure)
Last change
2 Nov 2026, 06:31 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Struts2 lets attackers run code on the server · Zero Radar