CISA added Apache Struts command injection flaw CVE-2016-3081 to its Known Exploited Vulnerabilities catalog under BOD 26-04.
The issue affects Struts versions 2.3.19 through 2.3.28 when Dynamic Method Invocation is enabled, allowing remote command execution.
Organizations running affected releases are advised to upgrade to fixed versions or disable DMI while conducting forensic triage for prior unauthorized access.
The issue concerns the Apache Struts software and allows unknown parties to run commands on a remote system if a specific dynamic method invocation feature is enabled.
CISA's intervention
The agency added the issue to its list of threats that are actively exploited in practice. US federal agencies were ordered to fix it by October 11, 2026.
In addition to simply installing patches, CISA stressed that those responsible should check their systems for any previous illegal access, as there is a risk that attacks may have already occurred.
Who is affected?
The issue is found in certain older versions of Apache Struts (specifically from 2.3.19 to 2.3.20.2, from 2.3.21 to 2.3.24.1 and from 2.3.25 to 2.3.28), if the relevant function is used. The software creators have released fixed versions, such as 2.3.20.3, 2.3.24.3 and 2.3.28.1.
The fact that a problem from 2016 still threatens systems shows that old applications connected to the internet remain vulnerable when not regularly updated.
What can organizations do?
Experts recommend that companies identify all applications using the software, check their version, and disable the problematic feature if an immediate update is not possible. Security teams are also urged to review their system logs for suspicious requests.
Top comments (0)