CVE-2016-3081: Apache Struts Command Injection Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 8, 2026

CVSS 8.1 · High⚠ Actively exploited (CISA KEV)

8.1

CVSS score

High

Severity

Active

CISA KEV

Ransomware use

Oct 11, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, with a federal patch deadline of Oct 11, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Details

AffectedApache · Struts

WeaknessCWE-77

CVSS base score8.1 (High)

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedApr 26, 2016

Added to CISA KEVOct 8, 2026

Federal patch deadlineOct 11, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2016-3081 being actively exploited?

Yes — CISA lists CVE-2016-3081 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2016-3081 affect?

CVE-2016-3081 affects Apache · Struts.

How do I fix CVE-2016-3081?

Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 11, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities