Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
CVE-2016-3081
Command injection RCE in Apache Struts Dynamic Method Invocation
CISA: Apache Struts Command Injection Vulnerability
- CVSS 3.1
- 8.1 high
- EPSS
- 97%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Apache Struts 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 allow remote code execution when Dynamic Method Invocation is enabled. An attacker triggers the flaw over the network, without credentials or user interaction, by sending a request that uses a method: prefix and chained expressions, which the framework treats as commands (CWE-77). Successful exploitation gives arbitrary code execution with high impact to confidentiality, integrity, and availability. The listed Struts releases are affected, and Oracle Siebel e-billing is also identified via CPE as incorporating the component, though no Siebel versions are specified in the data. A public proof-of-concept is available, CISA lists the issue in the Known Exploited Vulnerabilities catalog (added 2026-10-08) so exploitation in the wild is confirmed, EPSS is about 93.4 percent, and ransomware use is unknown.
What to do: Disable Dynamic Method Invocation if it is not required, and upgrade Apache Struts and products that embed it (including Oracle Siebel e-billing) to a release outside the affected 2.3.x ranges above, following vendor instructions and CISA BOD 26-04. Prioritize internet-exposed systems, review logs for method: prefix requests, and apply CISA forensics triage if compromise is suspected. Discontinue use if a fix or mitigation is unavailable.
| Product | Affected |
|---|---|
| Apache Struts | 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled |
| Oracle Siebel e-billing | — |
Estimated exposure
largetens of thousands of internet-facing Struts applications historically, with a larger enterprise install base — Order-of-magnitude estimate from Apache Struts 2’s widespread use in enterprise Java web applications and historical public internet scans of exposed Struts servers; the source data has no current install or scan count.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
KEVCISA Known Exploited Vulnerability
- Affected
- Apache Struts
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Products
- agile controller-campus firmware, anyoffice, logcenter, firehunter6000 firmware, oceanstor 5300 v3 firmware, oceanstor 5500 v3 firmware, oceanstor 5600 v3 firmware, oceanstor 5800 v3 firmware, oceanstor 6800 v3 firmware, oceanstor 18500 v3 firmware, oceanstor 18500f firmware, oceanstor 18800 v3 firmware
- Weakness
- CWE-77
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
9 storiesFBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78
CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
CISA added actively exploited Apache Struts command-injection flaw CVE-2016-3081 to the KEV catalog.
76
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA added exploited Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog with forensic triage required.
75
47