Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2016-3081 8.1
Apache · Struts · Added 2026-10-08 · Published 2016-04-26
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityApache Struts Command Injection Vulnerability
VendorApache
ProductStruts
Date added2026-10-08
Due date2026-10-11
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-77
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

NVD: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-10-08 21:06 UTC
Wall time0.7s
Searches1
Component defaultno
Sources https://cwiki.apache.org/confluence/display/WW/S2-032
https://web.archive.org/web/20171116134125/https://cwiki.apache.org/confluence/display/WW/S2-032
https://nvd.nist.gov/vuln/detail/CVE-2016-3081
https://github.com/zhzyker/exphub
https://raw.githubusercontent.com/zhzyker/exphub/master/struts2/struts2-032_cmd.py
https://raw.githubusercontent.com/zhzyker/exphub/master/struts2/struts2-032_poc.py
https://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec/
https://www.exploit-db.com/exploits/39756/
https://struts.apache.org/core-developers/default-properties
https://struts.apache.org/core-developers/action-configuration
https://raw.githubusercontent.com/apache/struts/STRUTS_2_3_28/core/src/main/resources/org/apache/struts2/default.properties

Hunting hypothesis agent

Hunt access logs for requests whose query string opens with method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS, the URL-encoded OGNL that exploits Struts Dynamic Method Invocation's method: prefix for RCE (CVE-2016-3081).

Research details

Componentstruts2-core Dynamic Method Invocation: ActionMapper handling of the method: parameter prefix (struts.
PreconditionsUnauthenticated HTTP access to a Struts 2 action endpoint on an affected release (2.3.19-2.3.20.2, 2.3.21-2.3.24.1, 2.3.25-2.3.28 per NVD; advisory lists 2.3.20-2.3.28) with struts.enable.DynamicMethodInvocation=true (default false in 2.3.x); no credentials or user interaction; fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1. agent
DeliveryHTTP request query string carrying OGNL in the method: parameter prefix (e.g. GET /app.action?method:%23_memberAccess...) against an app with DMI enabled
Public PoCyes
PoC URLs https://github.com/zhzyker/exphub/blob/master/struts2/struts2-032_cmd.py
https://github.com/zhzyker/exphub/blob/master/struts2/struts2-032_poc.py
https://www.exploit-db.com/exploits/39756/
https://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec/ Third-party repos; verify before use.
Advisoryhttps://cwiki.apache.org/confluence/display/WW/S2-032
Exploit notesCVSS attack complexity: HIGH | Weaponized public PoCs: exphub struts2-032_cmd.py sends a GET whose query string opens with method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS OGNL that execs #parameters.cmd[0] and writes command output to the HTTP response; Metasploit struts_dmi_exec and EDB-39756 are module-based. DMI must be enabled (default false in 2.3.x).
SummaryApache Struts 2 S2-032: unauthenticated remote code execution via OGNL passed in the method: parameter prefix when Dynamic Method Invocation is enabled in struts2-core's ActionMapper. NVD lists 2.3.19-2.3.20.2, 2.3.21-2.3.24.1 and 2.3.25-2.3.28 as affected; the advisory fixes 2.3.20.3, 2.3.24.3 and 2.3.28.1, with disabling DMI as the workaround. Weaponized public PoCs exist (exphub scripts, Metasploit struts_dmi_exec, EDB-39756); added to CISA KEV 2026-10-08.

Tia coverage

First reported2026-10-08

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-five-exploited-vulnerabilities-to-kev-catalog

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub