Skip to content

CVE-2016-3081 Apache Struts RCE Vulnerability

HighCVSS 8.1 EPSS 96.9% CISA KEV added 2026-10-08 · due 2026-10-11 Exploited in the wild Framework module Public exploit
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

CISA Known Exploited Vulnerability

Date added
2026-10-08
Due date (FCEB)
2026-10-11
Ransomware use
Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected products

ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) >= 2.3.19, <= 2.3.20.2 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.25, <= 2.3.28 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.21, <= 2.3.24.2 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.19, < 2.3.20.3 2.3.20.3
org.apache.struts/struts2-core(Maven) = 2.3.20 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20.1 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.21, < 2.3.24.3 2.3.24.3
org.apache.struts/struts2-core(Maven) = 2.3.24 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.24.1 No fix listed
org.apache.struts/struts2-core(Maven) >= 2.3.25, < 2.3.28.1 2.3.28.1
org.apache.struts/struts2-core(Maven) = 2.3.28 No fix listed
Huawei agile controller-campus firmware = v100r002c00 No fix listed
Huawei anyoffice = v200r005c00 No fix listed
Huawei anyoffice = v200r006c00 No fix listed
Huawei logcenter = v100r001c10 No fix listed
Huawei logcenter = v100r001c20 No fix listed
Huawei firehunter6000 firmware = v100r001c20 No fix listed
Huawei oceanstor 5300 v3 firmware = v300r001 No fix listed
Huawei oceanstor 5300 v3 firmware = v300r002 No fix listed
Huawei oceanstor 5300 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 5300 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 5500 v3 firmware = v300r001 No fix listed
Huawei oceanstor 5500 v3 firmware = v300r002 No fix listed
Huawei oceanstor 5500 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 5500 v3 firmware = v300r003c10 No fix listed
Show 52 more
ProductAffected versionsFixed in
Huawei oceanstor 5600 v3 firmware = v300r001 No fix listed
Huawei oceanstor 5600 v3 firmware = v300r002 No fix listed
Huawei oceanstor 5600 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 5600 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 5800 v3 firmware = v300r001 No fix listed
Huawei oceanstor 5800 v3 firmware = v300r002 No fix listed
Huawei oceanstor 5800 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 5800 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 6800 v3 firmware = v300r001 No fix listed
Huawei oceanstor 6800 v3 firmware = v300r002 No fix listed
Huawei oceanstor 6800 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 6800 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 18500 v3 firmware = v300r001 No fix listed
Huawei oceanstor 18500 v3 firmware = v300r002 No fix listed
Huawei oceanstor 18500 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 18500 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 18500f firmware = v300r001 No fix listed
Huawei oceanstor 18500f firmware = v300r002 No fix listed
Huawei oceanstor 18500f firmware = v300r003c00 No fix listed
Huawei oceanstor 18500f firmware = v300r003c10 No fix listed
Huawei oceanstor 18800 v3 firmware = v300r001 No fix listed
Huawei oceanstor 18800 v3 firmware = v300r002 No fix listed
Huawei oceanstor 18800 v3 firmware = v300r003c00 No fix listed
Huawei oceanstor 18800 v3 firmware = v300r003c10 No fix listed
Huawei oceanstor 18800f firmware = v300r001 No fix listed
Huawei oceanstor 18800f firmware = v300r002 No fix listed
Huawei oceanstor 18800f firmware = v300r003c00 No fix listed
Huawei oceanstor 18800f firmware = v300r003c10 No fix listed
Huawei oceanstor 9000 firmware = v100r001c01 No fix listed
Huawei oceanstor 9000 firmware = v100r001c30 No fix listed
Huawei oceanstor 9000 firmware = v300r005c00 No fix listed
Huawei oceanstor n8500 firmware = v200r001c09spc505 No fix listed
Huawei oceanstor n8500 firmware = v200r001c91spc205 No fix listed
Huawei oceanstor n8500 firmware = v200r001c91spc900 No fix listed
Huawei oceanstor n8500 firmware = v200r001c91spc901 No fix listed
Huawei oceanstor onebox firmware = v100r003c10 No fix listed
apache struts >= 2.3.20, < 2.3.20.3 2.3.20.3
apache struts >= 2.3.21, < 2.3.24.3 2.3.24.3
apache struts >= 2.3.25, < 2.3.28.1 2.3.28.1
oracle flexcube private banking = 2.0.0.0 No fix listed
oracle flexcube private banking = 2.0.1 No fix listed
oracle flexcube private banking = 2.2.0 No fix listed
oracle flexcube private banking = 12.0.1 No fix listed
oracle flexcube private banking = 12.0.3 No fix listed
oracle flexcube private banking = 12.1.0 No fix listed
oracle micros retail xbri loss prevention = 10.0.1 No fix listed
oracle micros retail xbri loss prevention = 10.5.0 No fix listed
oracle micros retail xbri loss prevention = 10.6.0 No fix listed
oracle micros retail xbri loss prevention = 10.7.0 No fix listed
oracle micros retail xbri loss prevention = 10.8.0 No fix listed
oracle micros retail xbri loss prevention = 10.8.1 No fix listed
oracle siebel e-billing = 7.1 No fix listed

References