Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Apache discloses four Struts flaws, including OGNL injection that can enable remote code execution.
66
CVE-2026-104711
OGNL injection in Apache Struts legacy REST mapper
- CVSS 3.1
- 9.8 critical
- EPSS
- 1%p72
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Struts has an expression-language injection flaw (CWE-917) in the legacy RESTful action mapper. If an application is configured to use that mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected, and Struts 7 is affected only when the OGNL allowlist is disabled, which is not the default. Affected releases are 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. No public proof of concept is known, and the issue is not listed in CISA KEV.
What to do: Upgrade to Apache Struts 6.12.0 or 7.4.0. Until then, do not use the legacy RESTful action mapper (the default mapper, the restful2 mapper, and the Struts REST plugin are not affected) and, on Struts 7, leave the OGNL allowlist enabled. Check action-mapper configuration to confirm the legacy mapper is not in use.
| Product | Affected |
|---|---|
| Apache Struts | 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 (7.x only when the OGNL allowlist is disabled) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
In the news
3 storiesApache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure
Four Apache Struts flaws can enable remote code execution, denial of service, or cross-user data disclosure.
66
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper
Apache Struts legacy RESTful action mapper is vulnerable to OGNL injection as CVE-2026-104711.
58