Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker
Affects Apache Struts 2.3.19 through 2.3.28 (struts2-core) when Dynamic Method Invocation is enabled. CVSS rates it 8.1 (high). Fixed in 2.3.20.3, 2.3.24.3, and 2.3.28.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
This vulnerability affects the Apache Struts web application framework when its Dynamic Method Invocation feature is enabled. A remote attacker could exploit it to execute arbitrary code on the affected server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-39756
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- org.apache.struts:struts2-coreMaven
From 2.3.19 · fixed in 2.3.20.3
- org.apache.struts:struts2-coreMaven
From 2.3.21 · fixed in 2.3.24.3
- org.apache.struts:struts2-coreMaven
From 2.3.25 · fixed in 2.3.28.1
References 12
securitytracker.com
struts.apache.org
oracle.com
rapid7.com
Exploit-DB
packetstormsecurity.com
Questions about CVE-2016-3081
What does this mean?
When Dynamic Method Invocation is enabled, a remote attacker can pass a method: prefix with a malicious expression and get remote code execution on the server.Source: cwiki.apache.org
Am I affected, and how do I check?
The affected ranges are 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.2, and 2.3.25 through 2.3.28, where the struts2-core version is in the vulnerable range and Dynamic Method Invocation is enabled. Check the struts2-core version in your project's dependencies and check whether the Dynamic Method Invocation setting is enabled.Source: cwiki.apache.org
What should I do about it?
Upgrade struts2-core to 2.3.20.3, 2.3.24.3, or 2.3.28.1, matching your release branch. If upgrading is not possible, disable Dynamic Method Invocation or implement your own version of ActionMapper.Source: cwiki.apache.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-08, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data