CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
CISA added actively exploited Apache Struts command-injection flaw CVE-2016-3081 to the KEV catalog.
CISA added CVE-2016-3081, a critical Apache Struts command-injection flaw, to the Known Exploited Vulnerabilities catalog on October 8, 2026, citing evidence of active exploitation. It affects Struts 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 when Dynamic Method Invocation is enabled, and Apache documents it in advisory S2-032. Crafted requests using the method: prefix can let a remote attacker execute arbitrary code on an exposed application server. Federal civilian agencies had a BOD 26-04 remediation deadline of October 11, 2026, and the entry requires forensic triage. CISA reports no known ransomware use.
- CISA added CVE-2016-3081 to the KEV catalog on October 8, 2026, for active exploitation.
- The Struts flaw allows remote command injection when Dynamic Method Invocation is enabled.
- Affected ranges are specific 2.3.19 through 2.3.28 releases, covered by Apache S2-032.
- Federal agencies faced an October 11, 2026, deadline and must perform forensic triage.
- CISA lists no known ransomware use associated with this vulnerability.
- CVEs
- CVE-2016-3081
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-3081 | Command injection RCE in Apache Struts Dynamic Method Invocation | 8.1 | 97% | KEVPoC ×2 | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2016-3081, a critical command injection vulnerability in Apache Struts, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.