{"id":"CVE-2016-3081","kind":"vulnerability","aliases":["CVE-2016-3081"],"related":[],"title":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is…","description":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"When Dynamic Method Invocation is enabled, Apache Struts lets a remote attacker inject commands through the method: prefix. The attacker gets arbitrary code execution on the server, and CISA lists it as actively exploited.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-10-08T00:00:00+00:00","products":[{"name":"Apache Struts","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Apache Struts","fixed":["2.3.20.3","2.3.24.3","2.3.28.1"],"affected":">= 2.3.20, <= 2.3.28 (except 2.3.20.3, 2.3.24.3)","ecosystem":"maven"},{"name":"huawei agile controller-campus firmware","fixed":[],"affected":"= v100r002c00","ecosystem":"vendor"},{"name":"huawei anyoffice","fixed":[],"affected":"= v200r005c00","ecosystem":"vendor"},{"name":"huawei anyoffice","fixed":[],"affected":"= v200r006c00","ecosystem":"vendor"},{"name":"huawei logcenter","fixed":[],"affected":"= v100r001c10","ecosystem":"vendor"},{"name":"huawei logcenter","fixed":[],"affected":"= v100r001c20","ecosystem":"vendor"},{"name":"huawei firehunter6000 firmware","fixed":[],"affected":"= v100r001c20","ecosystem":"vendor"},{"name":"huawei oceanstor 5300 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 5300 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 5300 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 5300 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 5500 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 5500 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 5500 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 5500 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 5600 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 5600 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 5600 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 5600 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 5800 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 5800 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 5800 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 5800 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 6800 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 6800 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 6800 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 6800 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 18500 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 18500 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 18500 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 18500 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 18500f firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 18500f firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 18500f firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 18500f firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 18800 v3 firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 18800 v3 firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"},{"name":"huawei oceanstor 18800 v3 firmware","fixed":[],"affected":"= v300r003c00","ecosystem":"vendor"},{"name":"huawei oceanstor 18800 v3 firmware","fixed":[],"affected":"= v300r003c10","ecosystem":"vendor"},{"name":"huawei oceanstor 18800f firmware","fixed":[],"affected":"= v300r001","ecosystem":"vendor"},{"name":"huawei oceanstor 18800f firmware","fixed":[],"affected":"= v300r002","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["apache-struts","exploited","java","package","rce","self-hosted"],"not_affected_if":["default-config","struts-outside-2.3.20-2.3.28"],"how_to_check":"Check the Struts version in your Maven or Gradle dependencies: affected are 2.3.20 to 2.3.28 (excluding 2.3.20.3 and 2.3.24.3).\nSearch configs for struts.enableDynamicMethodInvocation set to true.","fix":"Upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 as appropriate for your line, or disable Dynamic Method Invocation.\nFollow CISA BOD 26-04 guidance and the Apache S2-032 advisory.","status":"open","published_at":"2016-04-26T14:59:02+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:41:14+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:41:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 as appropriate for your line, or disable Dynamic Method Invocation.\nFollow CISA BOD 26-04 guidance and the Apache S2-032 advisory.","reach":"internet","title":"Apache Struts: command injection via method prefix runs code remotely","impact":"high","summary":"When Dynamic Method Invocation is enabled, Apache Struts lets a remote attacker inject commands through the method: prefix. The attacker gets arbitrary code execution on the server, and CISA lists it as actively exploited.","category":"package","nicknames":["S2-032"],"who_cares":["java","apache-struts","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the server remotely.","analyst_note":"Confirm the exact how_to_check config key and the Struts version mapping against the Apache S2-032 advisory; sources give no check command.","how_to_check":"Check the Struts version in your Maven or Gradle dependencies: affected are 2.3.20 to 2.3.28 (excluding 2.3.20.3 and 2.3.24.3).\nSearch configs for struts.enableDynamicMethodInvocation set to true.\nunknown","needs_analyst":true,"not_affected_if":["default-config","struts-outside-2.3.20-2.3.28"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3410,"output_tokens":537,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed Struts versions; find the vendor advisory and fixed release, plus the Dynamic Method Invocation detection method, from the CISA KEV entry and Apache Struts security bulletins.","search":"'-032':24A '-04':296C,322C,353C '-2016':18A,21A '-3081':19A,22A '18500':148A,153A,158A,163A '18500f':168A,172A,176A,180A '18800':184A,189A,194A,199A '18800f':204A,208A '2.3.19':3A '2.3.20.2':5A '2.3.21':6A '2.3.24.1':8A '2.3.25':10A '2.3.28':12A '26':295C,321C,352C '5300':48A,53A,58A,63A '5500':68A,73A,78A,83A '5600':88A,93A,98A,103A '5800':108A,113A,118A,123A '6800':128A,133A,138A,143A 'accord':285C 'action':281C 'activ':252B 'adher':349C 'agile':30A 'allow':263C 'anyoffice':36A,38A 'apach':1A,211B,226B,254C 'apache':25A,27A 'apache-strut':210B 'appli':282C 'applic':319C 'arbitrari':241B,268C 'asset':343C 'attack':231B,239B,265C 'base':300C 'bod':294C,320C,351C 'campus':33A 'cisa':248B,279C,292C,309C 'cloud':325C 'code':242B,269C 'command':233B,258C 'complianc':290C 'contain':256C 'controller':32A 'controller-campus':31A 'could':262C 'cve':17A,20A 'discontinu':328C 'dynam':14A,221B,274C 'enabl':225B,278C 'ensur':289C,348C 'evalu':341C 'execut':243B,267C 'exploit':213B,253B 'exposur':346C 'firehunter6000':44A 'firmware':34A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A,115A,120A,125A,130A,135A,140A,145A,150A,155A,160A,165A,169A,173A,177A,181A,186A,191A,196A,201A,205A,209A 'follow':318C 'forens':311C 'get':240B 'guidanc':307C,323C 'guidelin':355C 'host':219B 'huawei':29A,35A,37A,39A,41A,43A,46A,51A,56A,61A,66A,71A,76A,81A,86A,91A,96A,101A,106A,111A,116A,121A,126A,131A,136A,141A,146A,151A,156A,161A,166A,170A,174A,178A,182A,187A,192A,197A,202A,206A 'inject':232B,259C 'instruct':288C 'internet':345C 'invoc':16A,223B,276C 'java':214B 'let':228B 'list':249B 'logcenter':40A,42A 'method':15A,222B,236B,271C,275C 'mitig':283C,334C 'note':306C,317C 'oceanstor':47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,117A,122A,127A,132A,137A,142A,147A,152A,157A,162A,167A,171A,175A,179A,183A,188A,193A,198A,203A,207A 'packag':215B 'patch':354C 'prefix':237B,272C 'priorit':297C 'product':332C 'rce':216B 'remot':230B,264C 'requir':280C,313C 'respons':339C 'risk':302C 's2':23A 'secur':298C 'see':303C,314C 'self':218B 'self-host':217B 'server':246B 'servic':326C 'stakehold':337C 'strut':2A,212B,227B,255C 'struts':26A,28A 'triag':312C 'unavail':336C 'updat':299C 'url':304C,315C 'use':329C 'v3':49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,119A,124A,129A,134A,139A,144A,149A,154A,159A,164A,185A,190A,195A,200A 'vendor':287C 'via':270C 'vulner':260C","nicknames":["S2-032"],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-04-26T14:59:02+00:00","kev":{"dateAdded":"2026-10-08","dueDate":"2026-10-11","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2016-3081","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081","severity":null,"published_at":"2026-10-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2016-3081:109","url":null,"severity":null,"published_at":"2026-10-23T21:35:58+00:00","modified_at":"2026-10-23T21:35:58+00:00","first_seen_at":"2026-10-23T21:35:58+00:00","fetched_at":"2026-10-23T21:35:58+00:00","note":"Read Apache S2-032 advisory (affected 2.3.20-2.3.28 except 2.3.20.3/2.3.24.3; fixed 2.3.20.3, 2.3.24.3, 2.3.28.1). JPCERT confirms public PoC and attack attempts; vulhub reproduction linked. KEV lists exploited. Social search skipped (2016 bug, little current chatter). Mallory lists 2.3.19 as affected start but the vendor page says 2.3.20; I used the vendor."},{"source":"nvd","external_id":"CVE-2016-3081","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3081","severity":null,"published_at":"2016-04-26T14:59:02+00:00","modified_at":"2026-10-09T14:43:05+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1121,"url":"https://cwiki.apache.org/confluence/display/WW/S2-032","title":"Apache Struts S2-032","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1122,"url":"https://www.jpcert.or.jp/english/at/2016/at160020.html","title":"JPCert: Vulnerability in Apache Struts 2 (S2-032)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1123,"url":"https://github.com/vulhub/vulhub/tree/master/struts2/s2-032","title":"vulhub S2-032 reproduction","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}