· CVE-2016-3081
Apache Struts Command injection
8.1 CVSS · highExploitedCommand injection in Apache Struts. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1.
struts.apache.org · The vendor’s information prevails.
At a glance
- CVE
- CVE-2016-3081
- Product
- Apache Struts
- Vendor
- Apache Software Foundation
- Affected versions
- ≥ 2.3.20, < 2.3.20.3
- ≥ 2.3.21, < 2.3.24.3
- ≥ 2.3.25, < 2.3.28.1
- Fixed in
- 2.3.20.3, 2.3.24.3, 2.3.28.1
- CVSS
- 8.1 (high)
CVSS 3.1, scored by NVDCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited
- Yes, per CISA (in the KEV catalog since 8 October 2026)
- Weakness type
- CWE-77 (Command injection)
- Published
- Last modified
What to do
- Update to a fixed version: 2.3.20.3, 2.3.24.3 and 2.3.28.1 or later, depending on the release line you run.
- Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
- Since it is already exploited: after updating, check whether the system was compromised before.
- Also check test, staging and forgotten installations of the same software.
Original description
From the CVE record. The summary above is built from the structured data.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Official references
- struts.apache.org/docs/s2-032.html
- exploit-db.com/exploits/39756
- cisa.gov/known-exploited-vulnerabilities-catalog
Sources
Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.
Which software versions does your website give away? The free security check finds out.
Check for free