ZeroDay Findings
Sign inSign up

Findings

CVE-2016-3081

Apache Struts Command Injection Vulnerability

Published Apr 26, 2016 · updated Oct 9, 2026 · Apache Struts

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 26, 2016 · Catalog

    Detected

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

  2. Oct 8, 2026 · CISA KEV

    Known exploited

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  3. Oct 9, 2026 · Catalog

    Updated

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

  4. Oct 11, 2026 · CISA KEV

    Remediation due

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date Oct 11, 2026

Affected

  • cpe huawei/agile controller-campus firmwarev100r002c00
  • cpe huawei/anyofficev200r005c00
  • cpe huawei/anyofficev200r006c00
  • cpe huawei/firehunter6000 firmwarev100r001c20
  • cpe huawei/logcenterv100r001c10
  • cpe huawei/logcenterv100r001c20
  • cpe huawei/oceanstor 5300 v3 firmwarev300r001
  • cpe huawei/oceanstor 5300 v3 firmwarev300r002
  • cpe huawei/oceanstor 5500 v3 firmwarev300r001
  • cpe huawei/oceanstor 5600 v3 firmwarev300r001
  • cpe huawei/oceanstor 5800 v3 firmwarev300r001
  • cpe huawei/oceanstor 6800 v3 firmwarev300r001
  • vendor Apache Strutsversion unspecified

Sources

  • CISA KEVCVE-2016-3081

    Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

    cisa.gov
  • CVE.orgCVE-2016-3081

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-3081

    30-day exploitation probability 96.1%

    first.org
  • Exploit Database39756

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/struts_dmi_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2016-3081

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References