CVE-2016-3087
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
CVE-2016-3087- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
CVE-2016-3087- Updated
- 2026-11-02
EUVDEUVD-2022-4592 No score
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
EUVD-2022-4592- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mmj6-cjj4-hpr5
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
GHSA-mmj6-cjj4-hpr5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
CVE-2016-3087- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-mmj6-cjj4-hpr5
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
- Record
GHSA-mmj6-cjj4-hpr5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.3.19 up to 2.3.20.3 | 2.3.20.3 |
org.apache.struts:struts2-coreMaven |
2.3.21 up to 2.3.24.3 | 2.3.24.3 |
org.apache.struts:struts2-coreMaven |
2.3.25 up to 2.3.28.1 | 2.3.28.1 |
org.apache.struts:struts2-coreMaven |
2.3.19 up to 2.3.20.3, plus listed versions 2.3.202.3.20.1 |
2.3.20.3 |
org.apache.struts:struts2-coreMaven |
2.3.21 up to 2.3.24.3, plus listed versions 2.3.242.3.24.1 |
2.3.24.3 |
org.apache.struts:struts2-coreMaven |
2.3.25 up to 2.3.28.1, plus listed versions 2.3.28 |
2.3.28.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution (Metasploit) | 2016-06-10 |
| Exploit-DB | Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution | 2017-06-06 |
| Metasploit | Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution | 2016-06-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3087 is a critical vulnerability (CVSS 9.8) in Apache Struts, published June 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.9%, the 99th percentile. Fixed in org.apache.struts:struts2-core 2.3.20.3.
References
securitytracker.com/id/1036017
exploit-db.com/exploits/39919
struts.apache.org/docs/s2-033.html
www-01.ibm.com/support/docview.wss?uid=swg21987854
securityfocus.com/bid/90960
nvd.nist.gov/vuln/detail/CVE-2016-3087