CVE-2016-3081: Apache Struts RCE
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-08. Federal agencies must patch by 2026-10-11.
TL;DR - CVE-2016-3081 enables unauthenticated remote code execution in affected Apache Struts 2.3 releases when Dynamic Method Invocation is enabled. - Upgrade to 2.3.20.3, 2.3.24.3, 2.3.28.1, or a later supported release. - CISA lists the vulnerability as actively exploited; treat affected internet-facing systems as urgent investigation and remediation priorities.
Summary
CVE-2016-3081 is a remote-code-execution vulnerability in Apache Struts 2.3. The vulnerable request-processing behavior involves Dynamic Method Invocation (DMI), which allows request data to influence action-method resolution. Under the affected conditions, a remote attacker can provide a specially crafted method: prefix associated with chained expressions and execute arbitrary code in the application’s security context.
For background on interpreting vulnerability scores, see our guide to what CVSS means.
| Field | Value |
|---|---|
| CVE ID | CVE-2016-3081 |
| CVSS v3.1 score | 8.1 High |
| CVSS v3.1 vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | Network |
| Auth required | None |
| User interaction | None |
| Patch available | Yes |
| CISA KEV status | Yes |
| Affected condition | Apache Struts 2.3.x with DMI enabled |
The vulnerability is configuration-dependent, but that condition should not delay remediation. Affected Struts versions are legacy releases, public exploit references exist, and CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog on 2026-10-08. The catalog remediation deadline was 2026-10-11, so it had passed by this publication date.
Root Cause
The root cause is insufficient restriction of attacker-controlled input as it passes through Struts Dynamic Method Invocation and chained-expression handling. DMI permits a request to select an action method dynamically. In vulnerable releases, the method: prefix can reach expression-processing logic in a way that lets an attacker influence executable behavior rather than merely select an expected application method.
Exploitation requires an affected Struts deployment, DMI to be enabled, and a remotely reachable request path that invokes the vulnerable processing behavior. The attacker does not need an authenticated account or user interaction. Successful exploitation can result in arbitrary code execution as the web application, servlet container, or operating-system account running the service.
Disabling DMI can reduce exposure where the application does not require it, but it is a compensating control rather than a substitute for updating the library. Configuration may differ between applications, and a deployment can contain more than one Struts package or application archive. Verify the actual dependency version and effective runtime configuration.
Who’s Exposed
The NVD description identifies the following vulnerable Apache Struts 2.3 ranges when Dynamic Method Invocation is enabled:
| Affected range | Minimum fixed version for that branch |
|---|---|
| 2.3.19 through 2.3.20.2 | 2.3.20.3 |
| 2.3.21 through 2.3.24.1 | 2.3.24.3 |
| 2.3.25 through 2.3.28 | 2.3.28.1 |
Advisory database range data also expresses the middle branch as >= 2.3.21, <= 2.3.24.2. For asset-management purposes, treat Struts 2.3.24.2 and earlier as affected unless the vendor of the application documents an equivalent fix. Versions later than the listed fixed releases should still be assessed for supportability and for other Struts vulnerabilities.
Potentially exposed products include custom Java web applications that package org.apache.struts:struts2-core, applications deployed in Tomcat or another servlet container, and vendor appliances or enterprise products that embed Struts. Huawei published a product advisory concerning the issue, and Oracle also referenced the vulnerability in Critical Patch Update material. Product owners must check the relevant vendor advisory because updating an embedded component may require a product-specific update rather than a manually replaced JAR file.
Severity Breakdown
The CVSS v3.1 score is 8.1 High. For more context, review the CVSS metric glossary.
| Metric | Value | Operational meaning |
|---|---|---|
| Attack Vector | Network | Exploitation can occur remotely over HTTP or HTTPS. |
| Attack Complexity | High | Specific application and configuration conditions must be present. |
| Privileges Required | None | An attacker does not need an account. |
| User Interaction | None | No victim needs to click or approve an action. |
| Scope | Unchanged | The vulnerable component’s security authority is affected. |
| Confidentiality | High | Exploitation may expose application or host data. |
| Integrity | High | An attacker may modify applications, data, or configuration. |
| Availability | High | Code execution can enable disruption or destructive activity. |
The “High” attack-complexity rating reflects the requirement for DMI and a reachable vulnerable request path. It does not mean that exploitation is impractical. Network reachability, no authentication, no user interaction, and complete impact across confidentiality, integrity, and availability make exposed internet-facing systems high-priority targets.
CVSS is not a substitute for threat intelligence. CISA KEV inclusion is the stronger prioritization signal here because it records confirmed exploitation in the wild. Prioritize affected public-facing systems ahead of lower-scoring issues that have no evidence of exploitation.
Exploitation Status
CVE-2016-3081 is confirmed exploited in the wild based on its inclusion in CISA’s Known Exploited Vulnerabilities catalog. The catalog entry was added on 2026-10-08 and specified a remediation deadline of 2026-10-11. CISA’s ransomware-campaign field is recorded as unknown; there is no supplied evidence tying this CVE to a specific ransomware operation.
Public exploit material is also referenced. NVD links to a Packet Storm entry titled “Apache Struts 2.3.28 Dynamic Method Invocation Remote Code Execution” and to the Rapid7 Metasploit module exploit/linux/http/struts_dmi_exec. The Packet Storm page was not fully retrieved in the supplied research because it presented an anti-automation challenge. The reference is established, but the complete exploit contents should not be inferred from that retrieval.
Analyst’s Take: Treat an internet-facing Struts 2.3 deployment with DMI enabled as an incident-triage problem, not only a patching task. CISA KEV inclusion and public exploit references justify investigating for compromise even when logs do not show an obvious exploit request.
Defenders should assume that capable attackers can obtain enough information to develop or use exploitation tooling. No specific threat actor, victim set, payload, or campaign should be attributed without additional evidence. If a vulnerable application was internet-facing, investigate it even if current logs do not show an obvious exploit request.
Sources
- NVD: CVE-2016-3081
- CISA Known Exploited Vulnerabilities Catalog
- Packet Storm: Apache Struts 2.3.28 Dynamic Method Invocation Remote Code Execution
- Rapid7 Metasploit module reference
- Huawei PSIRT advisory
- GitHub Advisory Database: GHSA-8c6j-ffmf-q6vm
- INCIBE-CERT CVE entry
- HeroDevs vulnerability directory
The supplied research does not include independently verified counts for social mentions, GitHub references, or an EPSS percentile. Those metadata counters are therefore recorded as zero rather than presented as measured prevalence. Start by identifying every internet-facing Struts 2.3 deployment, confirming whether DMI is enabled, and patching or isolating affected systems; then investigate those systems for compromise.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start with software inventory. Search build files, application archives, container layers, and deployed libraries for org.apache.struts:struts2-core. A Maven dependency tree can identify direct and transitive versions:
mvn dependency:tree -Dincludes=org.apache.struts:struts2-core
For deployed WAR files, inspect the library directory:
unzip -l application.war | grep -Ei 'struts2-core-[0-9].*\.jar'
Review the effective Struts configuration for DMI. The commonly used setting is:
<constant name="struts.enable.DynamicMethodInvocation" value="false"/>
The exact configuration source may be XML, properties, framework defaults, or a vendor-managed application. Confirm the effective runtime value rather than relying only on a source repository setting.
Search web and WAF logs for requests containing a method: prefix, expression-language syntax, unexpected action methods, and unusual requests to Struts action endpoints. A generic detection query for a SIEM can begin with:
http.request.method:* AND
(
url.original:/.*method:.*/ OR
url.original:/.*(%25|%24|%7B|%7D).*/ OR
http.request.body.content:/.*method:.*/
)
The syntax above is intentionally generic because field names differ between SIEM products. Normalize and URL-decode request paths and parameters before matching. A useful web-server pattern to investigate is:
"POST /" ... "method:" ... " 200 "
This is not a definitive signature: legitimate applications may contain the string, and attackers can encode or alter it. Correlate suspicious requests with Java child processes such as shells, scripting interpreters, download utilities, or unexpected outbound connections. Preserve web, application, WAF, process, and network telemetry before deleting or rebuilding a potentially compromised host.
Remediation Steps
Upgrade each affected branch to at least its corresponding fixed release:
- Upgrade 2.3.19 through 2.3.20.2 deployments to 2.3.20.3.
- Upgrade 2.3.21 through 2.3.24.2 deployments to 2.3.24.3.
- Upgrade 2.3.25 through 2.3.28 deployments to 2.3.28.1.
- Prefer a currently supported Apache Struts release where application compatibility permits.
For a Maven-managed application, the branch-specific dependency update is:
<dependency>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-core</artifactId>
<version>2.3.28.1</version>
</dependency>
Use the fixed version appropriate for the application’s supported branch, test the complete application, then redeploy all instances. Do not assume that replacing a single JAR on one server protects a cluster, standby node, container image, or vendor appliance.
As a temporary workaround, disable DMI if the application does not require it:
<constant name="struts.enable.DynamicMethodInvocation" value="false"/>
Validate that the setting is active after deployment and monitor for application errors caused by legitimate dynamic method use. This workaround does not remove the vulnerable code and should not replace upgrading. If patching is not immediately possible, restrict access to the application through network controls, remove unnecessary internet exposure, apply vendor-recommended WAF protections, and disable the affected service when business operation permits.
If exploitation is suspected, isolate the host or application tier, preserve forensic evidence, and investigate for web shells, modified application files, newly created users, credential access, and outbound connections. Rotate secrets accessible to the application after determining the likely compromise scope, including database credentials, API keys, signing keys, and service-account credentials. A business password manager such as Try 1Password → can help teams securely manage replacement credentials and recovery codes during the response, but it does not replace incident containment or credential rotation.
Rebuild from trusted artifacts when arbitrary code execution is confirmed. If the incident affects regulated data or customer systems, follow applicable legal, contractual, and organizational notification procedures.