Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Apache discloses four Struts flaws, including OGNL injection that can enable remote code execution.
Apache Struts advisories describe four flaws that can lead to remote code execution, denial of service, or unintended data disclosure. CVE-2026-104711 is OGNL injection in the legacy RESTful action mapper and can yield code execution when that mapper is used. CVE-2026-104712 amplifies responses through BigDecimal rendering, CVE-2026-104713 lets unbounded REST request bodies exhaust memory, and CVE-2026-104714 can mix values across users via shared date formatters. Fixed versions are Struts 7.4.0 or later, or 6.12.0 or later on the 6.x line; three issues are rated Moderate and the REST body issue Important, with no active exploitation stated.
- CVE-2026-104711 OGNL injection may allow remote code execution.
- Unbounded REST bodies can exhaust server heap memory.
- BigDecimal rendering can amplify small requests into heavy responses.
- Shared date formatters may expose another user’s values.
- Patch with Struts 7.4.0+ or 6.12.0+; exploitation unconfirmed.
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-104711+3 related CVEs | OGNL injection in Apache Struts legacy REST mapper | 9.8 group max | 1% | PoC ×2 |
From the original article
2 min read at cybersecuritynews.com
Four security flaws described in the supplied Apache Struts advisories could expose affected applications to remote code execution, denial-of- service, and unintended data disclosure. Recommended fixes include Struts 7. 4.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.