CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA added exploited Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog with forensic triage required.
CISA added CVE-2016-3081, a command injection flaw in Apache Struts 2 (versions 2.3.19-2.3.28 with Dynamic Method Invocation enabled), to its Known Exploited Vulnerabilities catalog on October 8, 2026. Federal civilian agencies were given until October 11 to remediate under BOD 26-04, and CISA flagged the entry as requiring forensic triage. Successful exploitation allows remote code execution on affected servers. Fixed versions include 2.3.20.3, 2.3.24.3, and 2.3.28.1.
- CVE-2016-3081 actively exploited, added to KEV October 8, 2026
- Affects Struts 2.3.19-2.3.28 with Dynamic Method Invocation enabled
- CISA mandates forensic triage, not just patching
- Fixed in Struts 2.3.20.3, 2.3.24.3, 2.3.28.1
- CVEs
- CVE-2016-3081
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-3081 | Command injection RCE in Apache Struts Dynamic Method Invocation | 8.1 | 97% | KEVPoC ×2 | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in real-world attacks. The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.