CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2016-3081, a critical command injection vulnerability in Apache Struts, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.

This vulnerability affects Apache Struts deployments where Dynamic Method Invocation (DMI) is enabled.

Tracked as CWE-77, this flaw allows a remote attacker to execute arbitrary code by exploiting crafted requests that use the method: prefix.

Successful exploitation could give an attacker control of an affected web application server, enabling actions such as deploying web shells, stealing application data, conducting lateral movement, or establishing persistence.

Apache Struts Command Injection Flaw

According to the CVE record, the affected Apache Struts versions include 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28. Apache has published security guidance for this vulnerability under its S2-032 advisory.

CISA added this vulnerability to the KEV Catalog on October 8, 2026, and set an October 11, 2026, remediation deadline for applicable federal civilian executive branch agencies.

The agency’s entry requires organizations to implement vendor-provided mitigations in accordance with Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk. The KEV entry also categorizes the vulnerability as requiring forensic triage.

Including forensic triage requirements is crucial for defenders of internet-exposed Struts applications. Patching eliminates the vulnerability but does not confirm whether an attacker previously exploited it.

Therefore, security teams should review historical telemetry from web servers, reverse proxies, applications, authentication systems, endpoints, and networks for suspicious requests or follow-up activity related to compromised application servers.

Administrators should first identify all Apache Struts deployments, including legacy and externally hosted applications, then check whether DMI is enabled and whether the installed version falls within the affected ranges.

Organizations should upgrade to a vendor-supported, non-vulnerable version of Struts or apply the prescribed mitigation from Apache if an immediate upgrade is not possible.

Defenders should also evaluate their applications’ internet exposure, restrict access to administrative interfaces, rotate credentials on affected servers, and investigate unexpected process executions, newly scheduled tasks, altered application files, and unfamiliar outbound connections.

Given the history of Apache Struts vulnerabilities being targeted for opportunistic scanning and exploitation, organizations should treat exposed, unpatched instances as high-priority incident-response candidates.

CISA’s KEV listing does not indicate any known ransomware use associated with CVE-2016-3081, so that status is unknown. However, remote code execution on a public-facing application can provide an initial foothold that various threats, including financially motivated actors, may exploit.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.