What’s Vulnerable › Vulnerabilities

CVE-2016-3081: Apache Struts Command Injection Vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-08
• EPSS: 96.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-04-26 · updated 2026-10-09
• Weakness: CWE-77

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Affected products

• Apache Struts: from 2.3.20 before 2.3.20.3; from 2.3.21 before 2.3.24.3; from 2.3.25 before 2.3.28.1 — fixed in 2.3.20.3, 2.3.24.3, 2.3.28.1
• Huawei Agile Controller-Campus Firmware: v100r002c00
• AnyOffice V200R006C00: v200r005c00, v200r006c00
• Huawei Firehunter6000 Firmware: v100r001c20
• LogCenter V100R001C10: v100r001c10, v100r001c20
• Huawei Oceanstor 18500 V3 Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 18500F Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 18800 V3 Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 18800F Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 5300 V3 Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 5500 V3 Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• OceanStor 5600 V3 V300R003C00C10 and earlier versions: v300r001, v300r002, v300r003c00, v300r003c10
• OceanStor 5800 V3 V300R003C00: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 6800 V3 Firmware: v300r001, v300r002, v300r003c00, v300r003c10
• Huawei Oceanstor 9000 Firmware: v100r001c01, v100r001c30, v300r005c00
• Huawei Oceanstor N8500 Firmware: v200r001c09spc505, v200r001c91spc205, v200r001c91spc900, v200r001c91spc901
• Huawei Oceanstor Onebox Firmware: v100r003c10
• Oracle Corporation FLEXCUBE Private Banking: 2.0.0.0, 2.0.1, 2.2.0, 12.0.1, 12.0.3, 12.1.0
• Oracle Micros Retail Xbri Loss Prevention: 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1
• Oracle Siebel E-Billing: 7.1

How to fix

Upgrade to a fixed version: Apache Struts 2.3.20.3, 2.3.24.3, 2.3.28.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
• http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
• http://www.securityfocus.com/bid/87327
• http://www.securityfocus.com/bid/91787
• http://www.securitytracker.com/id/1035665
• https://struts.apache.org/docs/s2-032.html
• https://www.exploit-db.com/exploits/39756/
• http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html

Get alerted when CVE-2016-3081 or the next vulnerability affects your stack