Apache Struts, CVE-2016-3081: on CISA's exploited list

The bottom line

If you run Apache Struts 2 with Dynamic Method Invocation enabled, you are already past CISA's date of 11 October 2026. Switch that feature off first, then move to 2.3.20.3, 2.3.24.3 or 2.3.28.1. If you do not run Struts, you can stop reading.

Free analysis report · 9 pagesApache Struts, CVE-2016-3081: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

A remote attacker can send a crafted request using the method: prefix and run their own code on the server. The record says this works when Dynamic Method Invocation is enabled.

Why it matters

Our reading is that this flaw is useful to an attacker as a way in: it gives code execution on the server through an ordinary web request, and the record names no login step. The record published it in April 2016 with a score of 8.1. A Struts application still affected has probably gone unpatched for a long time and may not have an owner who watches it.

What the vendor's advisory says

We read two pages on cwiki.apache.org. In short:

• The Apache bulletin S2-032 says remote code execution can be performed via the method: prefix when Dynamic Method Invocation is enabled.
• It rates the maximum security impact as Important.
• Its recommendation is to disable Dynamic Method Invocation if possible, or upgrade to 2.3.20.3, 2.3.24.3 or 2.3.28.1.
• Its workaround is to disable Dynamic Method Invocation, or write your own ActionMapper based on the source of the recommended versions.
• It expects no compatibility issues when upgrading to those three versions.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "Our Struts version isn't listed, so we're fine." The bulletin and the record give slightly different starting versions. Compare against the fixed releases, not only the lower bound.
• "It scores 8.1, so it can wait." The score does not capture that CISA lists it as exploited. The record also names no login step.
• "We never turned that feature on." Someone may have enabled it years ago. Check the configuration rather than relying on memory.

How we would triage it

This is our judgement.

Step 1: Find the Struts version you run

• Ask your IT provider and any software supplier whether any application uses Struts 2.
• Find the Struts core library on each server and read its version. Compare it with 2.3.20.3, 2.3.24.3 and 2.3.28.1.

Step 2: Check whether Dynamic Method Invocation is on

• Look in the Struts configuration for the Dynamic Method Invocation setting. The bulletin says the flaw needs it enabled.

Step 3: Reduce exposure, then upgrade

• Disable Dynamic Method Invocation if you can. The bulletin names this as its first recommendation and as a workaround.
• Upgrade to 2.3.20.3, 2.3.24.3 or 2.3.28.1, whichever matches your release line. The bulletin expects no compatibility issues.

Step 4: Check for signs of misuse and confirm the fix

• Review web server logs for requests that use the method: prefix.
• Ask for written confirmation of the version now running and that the setting is off.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello. CISA lists Apache Struts CVE-2016-3081 as exploited, and its date of 11 October 2026 has passed. Please tell us whether we run Struts 2 anywhere, directly or inside a supplier's product, and which version. Please also say whether Dynamic Method Invocation is enabled and whether the system is reachable from the internet. The Apache bulletin S2-032 names fixed versions 2.3.20.3, 2.3.24.3 and 2.3.28.1, and recommends disabling that feature. Please confirm in writing, by the end of this week, the version we run, whether the feature is off, and when the fix will be in place. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Web requests whose parameters or paths contain the method: prefix.
• Unexpected programs started by the Java application server process, or new files in its working folders.
• Any change to the Struts configuration that turned Dynamic Method Invocation on.

The weakness behind it

CISA's entry classes this as CWE-77 (Improper Neutralization of Special Elements used in a Command).

• CWE-77: Improper Neutralization of Special Elements used in a Command →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

The CVE record, published by Redhat on 26 April 2016:

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

The record gives no version ranges. Use the vendor's advisory for the affected versions.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Whether the record's starting version of 2.3.19 or the bulletin's starting version of 2.3.20 is right. The two sources differ.
• Whether the attacks CISA lists need any particular configuration beyond Dynamic Method Invocation.
• Which products from other vendors bundle an affected Struts release. The sources do not list them.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.