cyfenced.com →

[ CVE-2016-3081 · Published 26 Apr 2016 ]

Remote code execution in Apache Struts with Dynamic Method Invocation

Exploited · CISA KEV CVSS 8.1 EPSS 96%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-08
  • EPSS: 96% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and it needs no credentials, but only applies when Dynamic Method Invocation is on.

Red alert if
You run an application on an affected Struts 2.3 version with Dynamic Method Invocation enabled and it is reachable from the internet.
Can wait if
Your Struts applications run a current release or have Dynamic Method Invocation disabled.
What it is
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28 let remote attackers run code through the method: prefix when Dynamic Method Invocation is enabled (Struts bulletin S2-032). The flaw dates from 2016 and is also present in third-party products built on Struts.
Impact
An attacker without credentials can run code on the application server, although the attack is harder to perform than most. Struts applications are often business systems with access to databases, so a compromise can expose customer and company data.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends a crafted request to a Struts application on the internet.
  2. T1059 Command and Scripting InterpreterThe injected expression runs commands as the application server user.
  3. T1505.003 Server Software Component: Web ShellA web shell is placed to keep access to the server.
  4. T1005 Data from Local SystemData the application can reach is read from the server and its databases.

What to do

  1. Upgrade applications to a current, supported Apache Struts release, following bulletin S2-032.
  2. If you cannot upgrade, disable Dynamic Method Invocation in the Struts configuration.
  3. Ask suppliers of products that embed Struts, including the listed Huawei and Oracle products, for their fixed versions.
  4. Review the application servers for unknown files and processes.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

CISA: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ References ]References