MediumVulnerabilityupdated 2 Nov 2026, 06:15 UTC

Apache Struts2 Core: cross-origin protection exemptions apply deployment-wide

New1 source, unconfirmed

Severity	MediumVulnerability
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	1 source, unconfirmedOnly one publisher so far, details may change

Timeline

2 Nov 2026, 06:10 UTC
Publicly disclosed
2 Nov 2026, 06:10 UTC
Reported by Full Disclosure · Full Disclosure
2 Nov 2026, 06:15 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide PathFull Disclosure · 2 Nov 2026, 06:10 UTC

Technical details

ID: ZR-b47252e7
Disclosed: 2 Nov 2026, 06:10 UTC
On Zero Radar: 2 Nov 2026, 06:15 UTC (5 min after disclosure)
Last change: 2 Nov 2026, 06:15 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Apache Struts2 Core: cross-origin protection exemptions apply deployment-wide · Zero Radar