CVE-2016-3081

Apache Struts RCE Vulnerability

8.1 HighIn KEVPublic exploitFix available

CVE-2016-3081 is a high vulnerability (CVSS 8.1) in Apache Struts, published April 26, 2016. CISA lists it as known to be exploited, since October 8, 2026. EUVD reports exploitation since October 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.5%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.20.3.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

96.5%Up 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

Record: CVE-2016-3081
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-77
Updated: 2026-11-02

CVE List 8.1

Record: CVE-2016-3081
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

EUVDEUVD-2022-3161 8.1

Record: EUVD-2022-3161
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8c6j-ffmf-q6vm 8.1

Apache Struts RCE Vulnerability

Record: GHSA-8c6j-ffmf-q6vm
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

CISA KEV No score

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

Record: CVE-2016-3081
Weakness: CWE-77
Updated: 2026-11-02

OSV 8.1

Record: CVE-2016-3081
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-8c6j-ffmf-q6vm 8.1

Apache Struts RCE Vulnerability

Record: GHSA-8c6j-ffmf-q6vm
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

Affected products

Show 8 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts2-core` Maven	2.3.19 to 2.3.20.2	2.3.20.3
`org.apache.struts:struts2-core` Maven	2.3.25 to 2.3.28	2.3.28.1
`org.apache.struts:struts2-core` Maven	2.3.21 to 2.3.24.2	2.3.24.3
`org.apache.struts:struts2-core` Maven	2.3.19 up to 2.3.20.3, plus listed versions 2.3.202.3.20.1	2.3.20.3
`org.apache.struts:struts2-core` Maven	2.3.21 up to 2.3.24.3, plus listed versions 2.3.242.3.24.1	2.3.24.3
`org.apache.struts:struts2-core` Maven	2.3.25 up to 2.3.28.1, plus listed versions 2.3.28	2.3.28.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Apache Struts Dynamic Method Invocation Remote Code Execution	2016-04-27
Exploit-DB	Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)	2016-05-02
Nuclei	Apache S2-032 Struts - Remote Code Execution

History

History
When	Changed	Sources
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV

References

Show 12 moreShow less