RCE in Apache Struts
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.961 (99.9th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 99.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.829 · newest: 0.961 · change: +0.132
Affected products
- Apache Struts — versions 2.0.0, 2.0.1, 2.0.2
- Huawei Agile Controller-Campus Firmware — versions v100r002c00
- Huawei Anyoffice — versions v200r005c00, v200r006c00
- Huawei Firehunter6000 Firmware — versions v100r001c20
- Huawei Logcenter — versions v100r001c10, v100r001c20
- Huawei Oceanstor 18500f Firmware — versions v300r001, v300r002, v300r003c00
- Huawei Oceanstor 18500 V3 Firmware — versions v300r001, v300r002, v300r003c00
- Huawei Oceanstor 18800f Firmware — versions v300r001, v300r002, v300r003c00
- Huawei Oceanstor 18800 V3 Firmware — versions v300r001, v300r002, v300r003c00
- Huawei Oceanstor 5300 V3 Firmware — versions v300r001, v300r002, v300r003c00
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1035665 (VDB Entry, Third Party Advisory, vdb-entry)
- struts.apache.org/docs/s2-032.html (Patch, Vendor Advisory)
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en (Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html (Patch, Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html (Third Party Advisory, Vendor Advisory)
- www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec (Third Party Advisory, Broken Link)
- www.exploit-db.com/exploits/39756/ (Exploit, VDB Entry, Third Party Advisory, exploit)
- www.securityfocus.com/bid/91787 (VDB Entry, Third Party Advisory, vdb-entry)
- packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invoca… (Exploit, Third Party Advisory)
- www.securityfocus.com/bid/87327 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2016-3081?
- CVE-2016-3081 is a high-severity vulnerability in Apache Struts, classified under Command Injection. CVSS score: 8.1/10. Published 2016-04-26.
- How severe is CVE-2016-3081?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2016-3081 known to be exploited?
- Yes. CVE-2016-3081 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-08), indicating it is being actively exploited. 31 public proof-of-concept repositories are indexed.