---
id: "CVE-2016-3081"
kind: "vulnerability"
aliases: ["CVE-2016-3081"]
title: "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Struts", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Apache Struts", "fixed": ["2.3.20.3", "2.3.24.3", "2.3.28.1"], "affected": ">= 2.3.20, <= 2.3.28 (except 2.3.20.3, 2.3.24.3)", "ecosystem": "maven"}, {"name": "huawei agile controller-campus firmware", "fixed": [], "affected": "= v100r002c00", "ecosystem": "vendor"}, {"name": "huawei anyoffice", "fixed": [], "affected": "= v200r005c00", "ecosystem": "vendor"}, {"name": "huawei anyoffice", "fixed": [], "affected": "= v200r006c00", "ecosystem": "vendor"}, {"name": "huawei logcenter", "fixed": [], "affected": "= v100r001c10", "ecosystem": "vendor"}, {"name": "huawei logcenter", "fixed": [], "affected": "= v100r001c20", "ecosystem": "vendor"}, {"name": "huawei firehunter6000 firmware", "fixed": [], "affected": "= v100r001c20", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5300 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5300 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5300 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5300 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5500 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5500 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5500 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5500 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5600 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5600 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5600 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5600 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5800 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5800 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5800 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 5800 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 6800 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 6800 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 6800 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 6800 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500f firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500f firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500f firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18500f firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800 v3 firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800 v3 firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800 v3 firmware", "fixed": [], "affected": "= v300r003c00", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800 v3 firmware", "fixed": [], "affected": "= v300r003c10", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800f firmware", "fixed": [], "affected": "= v300r001", "ecosystem": "vendor"}, {"name": "huawei oceanstor 18800f firmware", "fixed": [], "affected": "= v300r002", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["apache-struts", "exploited", "java", "package", "rce", "self-hosted"]
not_affected_if: ["default-config", "struts-outside-2.3.20-2.3.28"]
published_at: "2016-04-26T14:59:02+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:35:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3081", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is…

When Dynamic Method Invocation is enabled, Apache Struts lets a remote attacker inject commands through the method: prefix. The attacker gets arbitrary code execution on the server, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Struts affected ? fixed ?
- maven:Apache Struts affected >= 2.3.20, <= 2.3.28 (except 2.3.20.3, 2.3.24.3) fixed 2.3.20.3, 2.3.24.3, 2.3.28.1
- vendor:huawei agile controller-campus firmware affected = v100r002c00 fixed ?
- vendor:huawei anyoffice affected = v200r005c00 fixed ?
- vendor:huawei anyoffice affected = v200r006c00 fixed ?
- vendor:huawei logcenter affected = v100r001c10 fixed ?
- vendor:huawei logcenter affected = v100r001c20 fixed ?
- vendor:huawei firehunter6000 firmware affected = v100r001c20 fixed ?
- vendor:huawei oceanstor 5300 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 5300 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 5300 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 5300 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 5500 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 5500 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 5500 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 5500 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 5600 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 5600 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 5600 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 5600 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 5800 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 5800 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 5800 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 5800 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 6800 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 6800 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 6800 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 6800 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 18500 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 18500 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 18500 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 18500 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 18500f firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 18500f firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 18500f firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 18500f firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 18800 v3 firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 18800 v3 firmware affected = v300r002 fixed ?
- vendor:huawei oceanstor 18800 v3 firmware affected = v300r003c00 fixed ?
- vendor:huawei oceanstor 18800 v3 firmware affected = v300r003c10 fixed ?
- vendor:huawei oceanstor 18800f firmware affected = v300r001 fixed ?
- vendor:huawei oceanstor 18800f firmware affected = v300r002 fixed ?

## How to check

Check the Struts version in your Maven or Gradle dependencies: affected are 2.3.20 to 2.3.28 (excluding 2.3.20.3 and 2.3.24.3).
Search configs for struts.enableDynamicMethodInvocation set to true.

## Fix

Upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 as appropriate for your line, or disable Dynamic Method Invocation.
Follow CISA BOD 26-04 guidance and the Apache S2-032 advisory.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081
- 2026-10-23T21:35:58+00:00 analyst — Read Apache S2-032 advisory (affected 2.3.20-2.3.28 except 2.3.20.3/2.3.24.3; fixed 2.3.20.3, 2.3.24.3, 2.3.28.1). JPCERT confirms public PoC and attack attempts; vulhub reproduction linked. KEV lists exploited. Social search skipped (2016 bug, little current chatter). Mallory lists 2.3.19 as affected start but the vendor page says 2.3.20; I used the vendor.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-3081

## Documents

- [advisory] Apache Struts S2-032 https://cwiki.apache.org/confluence/display/WW/S2-032
- [mentions] JPCert: Vulnerability in Apache Struts 2 (S2-032) https://www.jpcert.or.jp/english/at/2016/at160020.html
- [poc] vulhub S2-032 reproduction https://github.com/vulhub/vulhub/tree/master/struts2/s2-032

## From the sources

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_