HighMalwareCVE-2016-3081
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
Cyber Security News·Source published ·1 min read
What happened?
CISA has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in real-world attacks. The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled. CISA added the vulnerability on October 8, 2026, and gave U.S. federal civilian agencies until October 11 to address it under Binding Operational Directive 26-04.
Key details
- CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog on October 8, 2026, confirming real-world attacks.
- The vulnerability is a command injection flaw in Apache Struts that allows remote code execution when Dynamic Method Invocation is enabled.
- Affected Struts 2 versions are 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 where DMI is enabled.
- Fixed releases are 2.3.20.3, 2.3.24.3, and 2.3.28.1.
- The vulnerability enables data theft, malware deployment, credential theft, and lateral movement into other network parts.
Affected
- Struts 2 versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 with DMI enabled.
- Apache Struts is a widely used Java framework for building web applications.
Fixes and mitigations
- Disable Dynamic Method Invocation where possible if immediate patching is not feasible.
What to look for
- Unusual requests containing method: values in web server logs.
- Unexpected child processes from Java services.
- Suspicious outbound traffic from the affected system.
- Changes to web application files that may indicate compromise.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.