{"id":"CVE-2018-11776","kind":"vulnerability","aliases":["CVE-2018-11776"],"related":[],"title":"Apache Struts: Apache Struts Remote Code Execution Vulnerability","description":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apache Struts, a Java web framework, can execute attacker-supplied code on the server when specific namespace or URL tag configurations are used. An unauthenticated remote attacker can run code on the server, which can lead to full takeover.","severity":"critical","cvss":9.3,"epss":0.99994,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apache Struts","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-struts","exploited","java","runtime","self-hosted"],"not_affected_if":["default-config","no-alwaysselectfullnamespace"],"how_to_check":null,"fix":"Upgrade Apache Struts to a fixed release per vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2018-08-22T13:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:04+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:37:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Struts to a fixed release per vendor instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Apache Struts, a Java web framework, can execute attacker-supplied code on the server when specific namespace or URL tag configurations are used. An unauthenticated remote attacker can run code on the server, which can lead to full takeover.","category":"runtime","who_cares":["java","apache-struts","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the server, potentially taking over the application host.","analyst_note":"Find the fixed Struts version and a config check for alwaysSelectFullNamespace and URL tags with no value/action in the Apache Struts security bulletin for CVE-2018-11776.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config","no-alwaysSelectFullNamespace"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000475,"input_tokens":2906,"output_tokens":368,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the fixed Struts version and a config check for alwaysSelectFullNamespace and URL tags with no value/action in the Apache Struts security bulletin for CVE-2018-11776.","search":"'-11776':11A,14A '-2018':10A,13A 'action':123C,140C 'allow':72C 'alwaysselectfullnamespac':83C 'apach':1A,3A,18B,26B,66C 'apache':15A 'apache-strut':17B 'appli':141C 'attack':35B,53B 'attacker-suppli':34B 'circumst':79C 'cisa':138C 'code':6A,37B,56B,75C 'configur':47B,99C,107C,132C 'contain':68C 'cve':9A,12A 'defin':96C 'doesn':118C 'execut':7A,33B,76C 'exploit':20B 'framework':31B 'full':64B 'host':25B 'instruct':145C 'isn':90C 'java':21B,29B 'lead':62B 'namespac':43B,112C,137C 'one':80C 'option':84C 'packag':106C,131C 'per':143C 'remot':5A,52B,74C 'requir':139C 'result':95C 'run':55B 'runtim':22B 'self':24B 'self-host':23B 'server':40B,59B 'set':92C,124C 'specif':42B 'strut':2A,4A,19B,27B,67C 'struts':16A 'suppli':36B 'tag':46B,116C 'takeov':65B 'time':103C,128C 'true':86C 'two':78C 'unauthent':51B 'under':98C 'updat':142C 'upper':105C,130C 'url':45B,115C 'use':49B,114C 'valu':89C,121C 'vendor':144C 'vulner':8A,70C 'web':30B 'wildcard':111C,136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-22T13:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-11776","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-11776","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2018-11776","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11776","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-11776","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11776","severity":null,"published_at":"2018-08-22T13:29:00+00:00","modified_at":"2026-06-17T01:36:34+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}