CVE-2016-3081

Apache Struts Command Injection Vulnerability

Apache StrutsFrameworks

CVSS

8.1High

ExploitationExploited in the wildAdded to KEV 8 Oct 2026CISA KEV

Exploit odds (EPSS)96.1%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Federal deadline11 Oct 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance

What fixes it

No source in this snapshot names a fixed version.

Timeline

26 Apr 2016, 14:00 UTCPublishedCVE List
27 Apr 2016Exploit code publicMetasploit
8 Oct 2026Added to CISA KEVCISA KEV

Public exploit code and templates 3

Exploit moduleApache Struts Dynamic Method Invocation Remote Code Execution 27 Apr 2016Metasploit
Remote exploitApache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit) 2 May 2016Exploit-DB
Scanner templateApache S2-032 Struts - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

Text from CVE List

Affected versions 1

n/aaffected: n/aCVE List