CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper
Apache Struts legacy RESTful action mapper is vulnerable to OGNL injection as CVE-2026-104711.
Lukasz Lenart disclosed CVE-2026-104711, a moderate-severity expression-language injection vulnerability in Apache Struts. If an application is configured to use the legacy RESTful action mapper, a crafted request can inject OGNL. Affected versions include 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The disclosure does not state that the flaw is being exploited.
- CVE-2026-104711 is moderate OGNL injection in the legacy RESTful mapper.
- Exposure requires the application to use that legacy action mapper.
- Ranges include 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0.
- CVEs
- CVE-2026-104711
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104711 | OGNL injection in Apache Struts legacy REST mapper | 9.8 | 1% | PoC ×2 |
From the original article
Posted by Lukasz Lenart on Oct 05 Severity: moderate Affected versions: - Apache Struts 2. 0. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.