{"id":"CVE-2025-68493","published":"2026-01-11T13:05:36Z","modified":"2026-09-14T12:04:26Z","title":"Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","vendor":"Apache Software Foundation","product":"Apache Struts","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Struts","versions":[">= 2.0.0, < 2.2.1"]},{"vendor":"Apache Software Foundation","product":"Apache Struts","versions":[">= 2.2.1, <= 6.1.0"]}],"description":{"text":"Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Struts, in the outdated XWork component, is affected by a missing XML validation flaw (Improper Restriction of XML External Entity Reference) that spans versions from 2.0.0 before 2.2.1 and from 2.2.1 through 6.1.0. An unauthenticated remote attacker over the network can exploit it with low complexity, but it requires user interaction, and the attack can lead to high confidentiality impact and high availability impact.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:27Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.50424,"percentile":0.98912,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-20","exploitedFirstSeen":"2026-07-20","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-20&host_type=src&vulnerability=cve-2025-68493","date":"2026-07-20"},{"url":"https://previdian.com/CVE-2025-68493","date":"2026-07-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-26&host_type=src&vulnerability=cve-2025-68493","date":"2026-07-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-27&host_type=src&vulnerability=cve-2025-68493","date":"2026-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-28&host_type=src&vulnerability=cve-2025-68493","date":"2026-07-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-30&host_type=src&vulnerability=cve-2025-68493","date":"2026-07-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-02&host_type=src&vulnerability=cve-2025-68493","date":"2026-08-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-03&host_type=src&vulnerability=cve-2025-68493","date":"2026-08-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-11&host_type=src&vulnerability=cve-2025-68493","date":"2026-08-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-20&host_type=src&vulnerability=cve-2025-68493","date":"2026-08-20"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"},{"id":"CWE-112","name":"Missing XML Validation"}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-069","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/11/2","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68493","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428559","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json","tags":["x_sadp-csaf-vex"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <=2.3.37",">=2.5.0, <=2.5.33",">=6.0.0, <6.1.1"],"patched":["6.1.1"],"from":["GHSA-qcfc-hmrc-59x7"],"provenance":"source"},{"ecosystem":"Maven","package":"com.opensymphony:xwork","vulnerableRanges":[">=2.0.0, <2.2.1"],"patched":[],"from":["GHSA-qcfc-hmrc-59x7"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":[">=2.2.1, <6.1.1"],"patched":[],"from":["GHSA-qcfc-hmrc-59x7"],"provenance":"source"}],"advisories":[{"id":"GHSA-qcfc-hmrc-59x7","url":"https://github.com/advisories/GHSA-qcfc-hmrc-59x7","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <=2.3.37"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcfc-hmrc-59x7","url":"https://github.com/advisories/GHSA-qcfc-hmrc-59x7","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.5.0, <=2.5.33"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcfc-hmrc-59x7","url":"https://github.com/advisories/GHSA-qcfc-hmrc-59x7","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=6.0.0, <6.1.1"],"patched":["6.1.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcfc-hmrc-59x7","url":"https://github.com/advisories/GHSA-qcfc-hmrc-59x7","severity":"HIGH","ecosystem":"Maven","package":"com.opensymphony:xwork","vulnerableRanges":[">=2.0.0, <2.2.1"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-qcfc-hmrc-59x7","url":"https://github.com/advisories/GHSA-qcfc-hmrc-59x7","severity":"HIGH","ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":[">=2.2.1, <6.1.1"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-1898","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-1898","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-02-04","earliestUrl":"https://github.com/hsltz/CVE-2025-68493","repos":[{"name":"hsltz/CVE-2025-68493","url":"https://github.com/hsltz/CVE-2025-68493","stars":2,"created":"2026-02-04"}]},"nuclei":[{"id":"CVE-2025-68493","name":"Apache Struts XWork - XML External Entity Injection","severity":"high","path":"http/cves/2025/CVE-2025-68493.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-68493.yaml"}],"first":{"date":"2026-02-04","source":"PoC-in-GitHub","url":"https://github.com/hsltz/CVE-2025-68493"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-01-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-68493","provenance":"source"},{"date":"2026-02-04","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hsltz/CVE-2025-68493","provenance":"source"},{"date":"2026-07-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-20&host_type=src&vulnerability=cve-2025-68493","provenance":"source"}],"speed":{"daysToPublicExploit":24,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":70.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 104 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.78,"detail":"percentile 0.9891"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}