SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
5 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2016-3081 · CVSS 8.1

Apache Struts: attackers can run commands on it

AFFECTSApache Struts

OFFICIAL NAME: Apache Struts Command Injection Vulnerability

WHAT IT IS · WEBSITE OR ONLINE STOREIt runs public websites, online stores or the software behind them.

DO THIS FIRSTAsk whoever runs your website or store to update it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

WHY THIS VERDICT Attacks are confirmed. Ready-made attack tools are public. The exploit prediction score is 97%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA Vulnrichment marks CVE-2016-3081 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2016-3081 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 3817 days after disclosure. CISA listed it 3817 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 11, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. APR 26, 2016
    CISA Vulnrichment marks CVE-2016-3081 as actively exploited
  2. APR 26, 2016
    Metasploit exploit module: Apache Struts Dynamic Method Invocation Remote Code Execution
  3. MAY 1, 2016
    Exploit-DB entry: Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)
  4. Attack activity. OCT 7, 2026
    Apache Struts Command Injection Vulnerability

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Apache S2-032 Struts - Remote Code Execution, OCT 24
  2. [2] CISA Known Exploited Vulnerabilities: Apache Struts Command Injection Vulnerability, OCT 7
  3. [3] Exploit-DB: Exploit-DB entry: Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit), MAY 1
  4. [4] Metasploit module metadata: Metasploit exploit module: Apache Struts Dynamic Method Invocation Remote Code Execution, APR 26
  5. [5] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2016-3081 as actively exploited, APR 26