CVE-2016-3081 KEVPublic exploit High · 8.1 EPSS 96.5%

Apache Struts Command Injection Vulnerability

Apache · Struts

Summary

Apache Struts 2, in the affected versions 2.3.19 through 2.3.28 (including the listed sub-ranges), contains a command injection flaw in the handling of Dynamic Method Invocation, where the "method:" prefix is not properly neutralised in chained expressions. An remote attacker with no privileges and no user interaction can execute arbitrary code, but only when Dynamic Method Invocation is enabled in the application's configuration.

Official description · NVD

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Breakdown

73.6 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 10 years after disclosure. Public exploit code (Metasploit) appeared 1 day after disclosure.

Disclosed26 Apr 2016day 0
Public exploit codeMetasploit27 Apr 2016+1 day
First seen exploitedVulnCheck KEV evidence23 Jul 2026+10 yrs
Added to CISA KEVEU database agrees8 Oct 2026+10 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

7 fixes in struts2-core over 3 months. The latest fix listed for struts2-core is 2.3.29.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.3.24.3CVE-2016-30937 Jun 2016
2.3.28CVE-2016-216212 Apr 2016
2.3.28CVE-2016-400312 Apr 2016
2.3.28.1CVE-2016-308126 Apr 2016KEV
2.3.28.1CVE-2016-308226 Apr 2016
2.3.28.1CVE-2016-30877 Jun 2016
2.3.29CVE-2016-44384 Jul 2016Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

remote unauthenticated exploitation of public-facing web framework

allow remote attackers to execute arbitrary code

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

arbitrary code execution via OGNL expression injection

allow remote attackers to execute arbitrary code

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2016-3081 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-8c6j-ffmf-q6vm

Upgrade to 2.5.33

Fixes this CVE and 9 other known vulnerabilities in this package (CVE-2016-3087, CVE-2017-12611, +7).

Still affected on this line by CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).

Set the version to 2.5.33 or later in your pom.xml or build.gradle.

First fixed in 2.3.28.1 for CVE-2016-3081.

Affected versions, by release line

If you run	Upgrade to
2.3.25 up to 2.3.28.1	2.5.33first fix for this CVE: 2.3.28.1
2.3.21 up to 2.3.24.3 Still affected on this line by CVE-2017-12611 (fixed in 2.3.34, a newer line); CVE-2017-5638 (fixed in 2.3.32, a newer line); CVE-2018-11776 (fixed in 2.3.35, a newer line); CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).	2.3.24.3
2.3.19 up to 2.3.20.3 Still affected on this line by CVE-2017-12611 (fixed in 2.3.34, a newer line); CVE-2017-5638 (fixed in 2.3.32, a newer line); CVE-2018-11776 (fixed in 2.3.35, a newer line); CVE-2019-0230 (fixed in 2.5.22, a newer line); CVE-2019-0233 (fixed in 2.5.22, a newer line); CVE-2020-17530 (fixed in 2.5.26, a newer line); CVE-2021-31805 (fixed in 2.5.30, a newer line); CVE-2023-50164 (fixed in 2.5.33, a newer line); CVE-2024-53677 (fixed in 6.4.0, a newer line); CVE-2025-68493 (no fix published).	2.3.20.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 26 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
20 more on OTX

References

12 links, grouped by NVD tag (11 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 8 Oct 2026. Federal due date 11 Oct 2026. No recorded ransomware use.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

ENISA

Marked exploited since 8 Oct 2026. EUVD-2022-3161

Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)EDB-39756 · remote · linux · 2016-05-02 · verified

, 30 Oct 2026

96.5%Top 0.12%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.88%).

3.1

8.1High · 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 100 days ago 5.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9988 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses26 pulses 3.0/3

CVSS base scorebase score 8.1 5.7/7

End-of-life productsupported or unknown 0.0

Total73.6

Record

Published: 26 Apr 2016
Modified: 9 Oct 2026
: CWE-77 Improper Neutralization of Special Elements used in a Command
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 26 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 1

US Government Resource 1

Third Party Advisory 9

How attackers get in

What they do

techniques