CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks

CISA has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in real-world attacks.

The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled.

CISA added the vulnerability on October 8, 2026, and gave U.S. federal civilian agencies until October 11 to address it under Binding Operational Directive 26-04.

The agency also marked the flaw as requiring forensic triage, meaning affected organizations should not treat patching as the only task. Security teams should also check whether attackers may have already accessed exposed systems.

Apache Struts is a widely used Java framework for building web applications. A successful exploit of CVE-2016-3081 may let an attacker send a specially crafted request to an affected application and execute commands on the underlying server.

This level of access can enable data theft, malware deployment, credential collection, or using the server as a path into other parts of the network. The weakness is classified as CWE-77, which covers cases where untrusted input can reach an operating system command interpreter.

The problem is linked to Apache Struts Dynamic Method Invocation (DMI). When enabled, an attacker may abuse the method prefix in a request to trigger arbitrary code execution.

Apache Struts Command Injection Vulnerability Exploited

Apache documentation and vulnerability records identify affected Struts 2 versions as 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 where DMI is enabled. Fixed releases include 2.3.20.3, 2.3.24.3, and 2.3.28.1.

Although the vulnerability was first disclosed in 2016, its inclusion in the CISA catalog shows that old internet-facing applications remain attractive targets for threat actors. Unsupported software, incomplete asset inventories, and forgotten application servers often leave known flaws open for years.

Organizations should identify every Apache Struts deployment, confirm its version, determine whether DMI is enabled, and review whether the application is accessible from the internet.

CISA says organizations should use its KEV catalog to prioritize vulnerability management because it tracks vulnerabilities known to be exploited in the wild.

For affected environments, the priority is to upgrade to a fixed Apache Struts release or apply the vendor’s recommended mitigation.

Teams that cannot patch immediately should disable Dynamic Method Invocation where possible, restrict public access to the application, and place the system behind appropriate network controls while preparing a permanent fix.

Organizations using cloud-hosted services should also ask providers whether their deployments rely on vulnerable Struts components.

Because CISA requires forensic triage for this entry, defenders should review web server and application logs for unusual requests containing method: values, unexpected child processes from Java services, new scheduled tasks, suspicious outbound traffic, or changes to web application files.

Incident-response teams should preserve relevant logs before making major changes, since evidence can help confirm whether exploitation occurred and what actions followed.

Security teams can also review Cyber Security News coverage on Apache Struts vulnerabilities and CISA Known Exploited Vulnerabilities for related patching and threat-intelligence updates.

The official CISA KEV catalog and the CVE record for CVE-2016-3081 remain key references for defenders tracking this actively exploited Apache Struts flaw.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.