NewApp Monitoring is liveSign up free
AgentbeamBeta
Known exploited vulnerability · Apache

CVE-2016-3081: Apache Struts Command Injection Vulnerability

highCVSS 3.1 8.1Exploited

Apache Struts 2.3.20 through 2.3.28 lets a remote attacker run code on the server through the `method:` prefix, when Dynamic Method Invocation is enabled. Apache's fixed releases are 2.3.20.3, 2.3.24.3 and 2.3.28.1. CISA added it to the KEV catalog on 2026-10-08, and public exploit code exists.

Published Apr 26, 2016 · Updated Oct 9, 2026 · Analysis Oct 25, 2026

What an attacker can do

Struts 2 can map a request parameter with a method: prefix to the action method to call. With Dynamic Method Invocation (DMI) on, the value after the prefix is evaluated as an expression, so an attacker can send a crafted expression in a normal HTTP request and run arbitrary code with the privileges of the application server. No login and no user interaction are needed. The CVSS vector rates complexity as high, mostly because the target must have DMI enabled.

The NVD text gives the affected ranges as 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28. Apache's bulletin S2-032 lists 2.3.20 through 2.3.28, excluding 2.3.20.3 and 2.3.24.3. Treat the broader range as in scope.

A successful attack gives the attacker the same access as the Java process: application data, database credentials in its configuration, and a foothold in the network behind the web tier. A public exploit is listed with the references, and the vulnerability appears in the CISA catalog of known exploited vulnerabilities. Applications that were built years ago and never updated are the typical victims.

Who is affected

Apache Struts 2.3.20 through 2.3.28 (the NVD range starts at 2.3.19), except 2.3.20.3 and 2.3.24.3, and only when Dynamic Method Invocation is enabled. Find the Struts version in the application's libraries:

find / -name 'struts2-core*.jar' 2>/dev/null

The jar name carries the version. DMI is controlled by the struts.enable.DynamicMethodInvocation constant in struts.xml or struts.properties. Look for it being set to true.

How to fix it

Upgrade to Struts 2.3.20.3, 2.3.24.3 or 2.3.28.1, the releases named in Apache's bulletin, which states no backward compatibility issues are expected. Rebuild and redeploy the application.

Workarounds from the bulletin: disable Dynamic Method Invocation, or write your own ActionMapper based on the source code of the recommended versions.

CISA's required action for KEV: apply mitigations per vendor instructions, follow BOD 26-04 guidance and its forensics triage requirements, or stop using the product if mitigations are unavailable. The due date was 2026-10-11 and binds US federal agencies. Because code execution is possible, check hosts that ran vulnerable versions for compromise before assuming a patch is enough.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

How to tell if you were hit

Search web server and application access logs for requests whose URL or parameters contain method: followed by OGNL-style text such as %23 or #_memberAccess, @java.lang.Runtime, or ProcessBuilder. Look on the host for unexpected child processes of the Java application server (shells, curl, wget), new files in the web root or temp directories, and outbound connections from the server to unfamiliar hosts. Treat a hit as a possible full compromise of the server.

Original advisory

From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Questions

Is CVE-2016-3081 exploited in the wild?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-08, and a public exploit is listed in the references.

Am I safe if Dynamic Method Invocation is disabled?

Apache lists disabling DMI as a workaround for this flaw. Upgrading to 2.3.20.3, 2.3.24.3 or 2.3.28.1 is the actual fix.

Which Struts versions are fixed?

2.3.20.3, 2.3.24.3 and 2.3.28.1 on their respective branches. Later 2.3 or 2.5 releases are outside the affected ranges listed by Apache.

References

Read for this analysis:

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology

More Apache vulnerabilities

All Apache entries