CISA Flags Apache Struts RCE Vulnerability Amid Ongoing Cyber Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the long-known Apache Struts vulnerability CVE-2016-3081 to its Known Exploited Vulnerabilities (KEV) catalog after confirming its use in active attacks against vulnerable systems.

The flaw is a command injection vulnerability affecting Apache Struts deployments where Dynamic Method Invocation (DMI) is enabled. Successful exploitation allows a remote attacker to execute arbitrary commands on the underlying server through specially crafted requests.

Following its inclusion in the KEV catalog on October 8, 2026, CISA directed U.S. federal civilian agencies to remediate the issue by October 11 under Binding Operational Directive 26-04. The agency also classified the vulnerability as requiring forensic triage, emphasizing that organizations should investigate for potential compromise in addition to applying patches.

Apache Struts, a widely adopted Java web application framework, remains prevalent across enterprise environments. Exploitation of CVE-2016-3081 can grant attackers the ability to run commands, potentially leading to data theft, malware deployment, credential harvesting, lateral movement, and broader network compromise. The vulnerability is categorized under CWE-77, which involves improper neutralization of input passed to operating system command interpreters.

The issue stems from the framework’s Dynamic Method Invocation feature. When enabled, attackers can manipulate method prefixes within requests to trigger unauthorized execution of code.

Affected Versions

According to Apache security advisories, the vulnerability impacts the following Apache Struts 2 releases when DMI is enabled:

• 2.3.19 through 2.3.20.2
• 2.3.21 through 2.3.24.1
• 2.3.25 through 2.3.28

Patched versions include:

• 2.3.20.3
• 2.3.24.3
• 2.3.28.1

Although originally disclosed in 2016, the vulnerability’s addition to the KEV catalog highlights how aging internet-facing applications continue to provide opportunities for threat actors. Incomplete asset inventories, forgotten servers, and legacy software often leave known weaknesses exposed for years.

Recommended Actions

Organizations should:

• Inventory all Apache Struts deployments.
• Verify software versions and determine whether DMI is enabled.
• Identify internet-exposed applications.
• Upgrade to a fixed release or implement vendor-recommended mitigations.
• Disable Dynamic Method Invocation wherever feasible.
• Restrict external access and apply additional network controls until remediation is complete.
• Consult cloud service providers to confirm whether vulnerable Struts components are present in hosted environments.

Because CISA requires forensic review for this vulnerability, defenders should also examine web and application logs for indicators of exploitation, including suspicious method: parameters, unexpected Java child processes, unusual outbound connections, unauthorized scheduled tasks, and unexplained changes to application files.

Incident response teams are advised to preserve logs and forensic evidence before making substantial configuration changes, as this information may be critical in determining whether systems were compromised and what actions attackers performed.

CISA continues to recommend using the Known Exploited Vulnerabilities (KEV) Catalog as a priority resource for vulnerability management, helping organizations focus remediation efforts on flaws actively targeted in the wild.