CISA Warns of Critical Apache Struts RCE Vulnerability Exploited in Attacks

Key Takeaways

• The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2016-3081, a critical Apache Struts remote code execution (RCE) vulnerability, to its Known Exploited Vulnerabilities catalog.
• This command injection flaw allows attackers to execute arbitrary code on vulnerable servers where Dynamic Method Invocation (DMI) is enabled.
• Affected organizations, particularly U.S. federal civilian agencies, must patch immediately and conduct forensic triage due to confirmed in-the-wild exploitation.
• The vulnerability impacts Apache Struts 2 versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 with DMI enabled.

CISA Flags Apache Struts RCE Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an Apache Struts vulnerability, identified as CVE-2016-3081, after confirming its active exploitation in real-world attacks. This command injection flaw, initially disclosed in 2016, allows remote attackers to execute arbitrary code on susceptible servers, prompting CISA to add it to its Known Exploited Vulnerabilities catalog on October 8, 2026.

The urgency of this threat is underscored by CISA’s directive to U.S. federal civilian agencies, mandating remediation by October 11 under Binding Operational Directive 26-04. Furthermore, CISA has marked this vulnerability as requiring “forensic triage,” indicating that patching alone is insufficient. Organizations must also investigate whether their systems have already been compromised.

Understanding the Vulnerability: CVE-2016-3081

CVE-2016-3081 is a command injection vulnerability within Apache Struts, a widely adopted Java framework for developing web applications. When Dynamic Method Invocation (DMI) is enabled, an attacker can craft a malicious request to an affected application, leading to the execution of commands on the underlying server. This flaw is categorized as CWE-77, which addresses weaknesses where untrusted input can be processed by an operating system command interpreter.

Successful exploitation grants attackers significant control, potentially enabling data exfiltration, deployment of malware, credential harvesting, or using the compromised server as a pivot point into other network segments. The core of the problem lies in the abuse of the method prefix in requests when Apache Struts DMI is active, allowing for arbitrary code execution.

Apache’s documentation specifies that Struts 2 versions 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28 are vulnerable when DMI is enabled. Patched versions include 2.3.20.3, 2.3.24.3, and 2.3.28.1.

The inclusion of this nearly decade-old flaw in CISA’s catalog highlights a persistent challenge: older, internet-facing applications often remain unpatched. Factors such as unsupported software, incomplete asset inventories, and forgotten application servers create fertile ground for threat actors to exploit known vulnerabilities for extended periods.

What You Should Do

• Identify and Inventory: Conduct a thorough audit to identify all Apache Struts deployments within your environment. Determine the exact version of each instance.
• Verify DMI Status: For each identified Struts instance, confirm whether Dynamic Method Invocation (DMI) is enabled.
• Assess Exposure: Determine if any vulnerable Apache Struts applications are publicly accessible from the internet.
• Prioritize Patching: Immediately upgrade all affected Apache Struts deployments to a fixed release (e.g., 2.3.20.3, 2.3.24.3, or 2.3.28.1).
• Apply Mitigations: If immediate patching is not feasible, disable Dynamic Method Invocation (DMI) where possible. Restrict public access to the application and place the system behind appropriate network controls (e.g., web application firewalls, access control lists).
• Consult Cloud Providers: If using cloud-hosted services, inquire with your providers about their reliance on potentially vulnerable Struts components.
• Conduct Forensic Triage: Due to CISA’s directive, perform a forensic investigation. Review web server and application logs for suspicious activity, including unusual requests containing method: values, unexpected child processes originating from Java services, new scheduled tasks, suspicious outbound network traffic, or unauthorized modifications to web application files.
• Preserve Evidence: Before implementing major changes or patches, preserve all relevant logs and system states. This evidence is crucial for confirming exploitation and understanding the scope of any potential breach.
• Stay Informed: Regularly consult the official CISA KEV catalog and the CVE record for CVE-2016-3081 for the latest intelligence and updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.